Joe Sandbox Cloud Basic Analysis Report

Loading Joe Sandbox Report ...

Edit tour

Windows Analysis Report
Laurier Partners Proposal.eml

Overview

General Information

Sample name:Laurier Partners Proposal.eml
Analysis ID:1578697
MD5:05d116072230ff1d104dd7cc8c61878a
SHA1:7357a791c968bc1b0ca512b9ea9ef83910676cef
SHA256:2138bf71b1eec3041491d19431720da07dd2ed09957561c4564f1cd8e5f54cdd
Infos:

Detection

HTMLPhisher
Score:64
Range:0 - 100
Whitelisted:false
Confidence:100%

Signatures

Yara detected HtmlPhish10
AI detected landing page (webpage, office document or email)
AI detected potential phishing Email
AI detected suspicious Javascript
Suspicious MSG / EML detected (based on various text indicators)
HTML body contains low number of good links
HTML title does not match URL
Queries the volume information (name, serial number etc) of a device
Sigma detected: Office Autorun Keys Modification
Stores files to the Windows start menu directory

Classification

Process Tree

  • System is w10x64_ra
  • OUTLOOK.EXE (PID: 6520 cmdline: "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Laurier Partners Proposal.eml" MD5: 91A5292942864110ED734005B7E005C0)
    • ai.exe (PID: 6868 cmdline: "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5683E82F-A1AE-4D8F-BF62-CB405ABCE4BD" "C9846EE5-A715-4110-8CF9-B8DBCF5C0F1A" "6520" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx" MD5: EC652BEDD90E089D9406AFED89A8A8BD)
    • chrome.exe (PID: 6372 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://yesyes-cad3.powerappsportals.com/ MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
      • chrome.exe (PID: 6640 cmdline: "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,12292628730577502130,9354259266995993712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8 MD5: 45DE480806D1B5D462A7DDE4DCEFC4E4)
  • cleanup

Yara Signatures

Dropped Files

SourceRuleDescriptionAuthorStrings
dropped/chromecache_148JoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

    HTML

    SourceRuleDescriptionAuthorStrings
    2.1.pages.csvJoeSecurity_HtmlPhish_10Yara detected HtmlPhish_10Joe Security

      Sigma Signatures

      Sigma detected: Office Autorun Keys Modification
      Source: Registry Key setAuthor: Victor Sergeev, Daniil Yugoslavskiy, Gleb Sukhodolskiy, Timur Zinniatullin, oscd.community, Tim Shelton, frack113 (split): Data: Details: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 , EventID: 13, EventType: SetValue, Image: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE, ProcessId: 6520, TargetObject: HKEY_CURRENT_USER\SOFTWARE\Microsoft\Office\16.0\Outlook\Addins\OneNote.OutlookAddin\1

      Suricata Signatures

      ⊘No Suricata rule has matched

      Joe Sandbox Signatures

      Click to jump to signature section

      Show All Signature Results

      Phishing

      barindex
      Yara detected HtmlPhish10
      Source: Yara matchFile source: 2.1.pages.csv, type: HTML
      Source: Yara matchFile source: dropped/chromecache_148, type: DROPPED
      AI detected landing page (webpage, office document or email)
      Source: EmailJoe Sandbox AI: Page contains button: 'VIEW SHARED DOCUMENT' Source: 'Email'
      Source: EmailJoe Sandbox AI: Email contains prominent button: 'view shared document'
      Source: https://yesyes-cad3.powerappsportals.com/Joe Sandbox AI: Page contains button: 'CLICK HERE TO ACCESS DOCUMENT' Source: '1.0.pages.csv'
      AI detected potential phishing Email
      Source: EmailJoe Sandbox AI: Detected potential phishing email: The email appears to be a signature block repeated multiple times with no actual message content. The sender and recipient are the same person/address which is highly suspicious. Contains a suspicious PowerApps portal link mixed in with legitimate business contact information
      AI detected suspicious Javascript
      Source: 0.30.id.script.csvJoe Sandbox AI: Detected suspicious JavaScript with source url: https://ripack.store/construct/sanga... This script demonstrates several high-risk behaviors, including data exfiltration and redirects to a suspicious domain. The script collects the user's email input and appends it to a Base64-encoded URL, which is then used to redirect the user. This behavior is highly suspicious and could be indicative of a phishing or malware attempt.
      Suspicious MSG / EML detected (based on various text indicators)
      Source: MSG / EMLOCR Text: ShareFile Attachments Laurier Partners Project proposal.pdf Laurier Partners RFQ.pdf Laurier Partners - Contact Form Submission.pdf Laurier Partners & Ref.pdf Laurier Partners Statement.pdf VIEW SHARED DOCUMENT Robert Hain uses ShareFile to share documents securely. Robert C Hain Laurier Partners Strategy Advisors +1 902 830 3210 hain@laurierpartners.com Rob Hain on LinkedIn www.laurierpartners.com Expires December 28 2024 4 MB 4MB 4MB 4MB 4MB
      Source: https://ripack.store/construct/sangaHTTP Parser: Number of links: 0
      Source: https://ripack.store/construct/sangaHTTP Parser: Title: ****---*** does not match URL
      Source: EmailClassification: Credential Stealer
      Source: https://yesyes-cad3.powerappsportals.com/HTTP Parser: No favicon
      Source: https://ripack.store/construct/sangaHTTP Parser: No favicon
      Source: https://ripack.store/construct/sangaHTTP Parser: No <meta name="author".. found
      Source: https://ripack.store/construct/sangaHTTP Parser: No <meta name="copyright".. found
      Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49717 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49784 version: TLS 1.2
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 40.126.53.15
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 204.79.197.203
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 23.218.208.109
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 4.175.87.197
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: unknownTCP traffic detected without corresponding DNS query: 20.189.173.10
      Source: unknownTCP traffic detected without corresponding DNS query: 192.229.211.108
      Source: global trafficDNS traffic detected: DNS query: yesyes-cad3.powerappsportals.com
      Source: global trafficDNS traffic detected: DNS query: content.powerapps.com
      Source: global trafficDNS traffic detected: DNS query: www.google.com
      Source: global trafficDNS traffic detected: DNS query: ripack.store
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49744
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49742
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49741
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49740
      Source: unknownNetwork traffic detected: HTTP traffic on port 49766 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49746 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49739
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49738
      Source: unknownNetwork traffic detected: HTTP traffic on port 49717 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49734
      Source: unknownNetwork traffic detected: HTTP traffic on port 49772 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49733
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49732
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49731
      Source: unknownNetwork traffic detected: HTTP traffic on port 49732 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49697
      Source: unknownNetwork traffic detected: HTTP traffic on port 49784 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49728 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49763 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49700 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49729
      Source: unknownNetwork traffic detected: HTTP traffic on port 49752 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49728
      Source: unknownNetwork traffic detected: HTTP traffic on port 49777 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49727
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49725
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49724
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49723
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49722
      Source: unknownNetwork traffic detected: HTTP traffic on port 49731 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49697 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49729 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49760 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49745 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49718
      Source: unknownNetwork traffic detected: HTTP traffic on port 49751 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49717
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49713
      Source: unknownNetwork traffic detected: HTTP traffic on port 49774 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49734 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49740 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49765 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49768 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49723 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49754 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49771 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49733 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49700
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49786
      Source: unknownNetwork traffic detected: HTTP traffic on port 49779 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49784
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49783
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49780
      Source: unknownNetwork traffic detected: HTTP traffic on port 49727 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49762 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49776 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49713 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49759 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49753 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49779
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49778
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49777
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49776
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49775
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49774
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49773
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49772
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49771
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49770
      Source: unknownNetwork traffic detected: HTTP traffic on port 49724 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49742 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49767 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49780 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49773 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49718 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49768
      Source: unknownNetwork traffic detected: HTTP traffic on port 49739 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49756 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49767
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49766
      Source: unknownNetwork traffic detected: HTTP traffic on port 49758 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49765
      Source: unknownNetwork traffic detected: HTTP traffic on port 49783 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49764
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49763
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49762
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49761
      Source: unknownNetwork traffic detected: HTTP traffic on port 49678 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49760
      Source: unknownNetwork traffic detected: HTTP traffic on port 49725 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49741 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49764 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49770 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49722 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49759
      Source: unknownNetwork traffic detected: HTTP traffic on port 49778 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49758
      Source: unknownNetwork traffic detected: HTTP traffic on port 49738 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49755 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49756
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49755
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49754
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49753
      Source: unknownNetwork traffic detected: HTTP traffic on port 49673 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49752
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49751
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49750
      Source: unknownNetwork traffic detected: HTTP traffic on port 49786 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49761 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49747 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49744 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49775 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 49750 -> 443
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49747
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49746
      Source: unknownNetwork traffic detected: HTTP traffic on port 443 -> 49745
      Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49713 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 23.218.208.109:443 -> 192.168.2.16:49718 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49717 version: TLS 1.2
      Source: unknownHTTPS traffic detected: 4.175.87.197:443 -> 192.168.2.16:49784 version: TLS 1.2
      Source: classification engineClassification label: mal64.phis.winEML@18/51@16/92
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile created: C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241220T0036080722-6520.etl
      Source: unknownProcess created: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" /eml "C:\Users\user\Desktop\Laurier Partners Proposal.eml"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5683E82F-A1AE-4D8F-BF62-CB405ABCE4BD" "C9846EE5-A715-4110-8CF9-B8DBCF5C0F1A" "6520" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://yesyes-cad3.powerappsportals.com/
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,12292628730577502130,9354259266995993712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe "C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exe" "5683E82F-A1AE-4D8F-BF62-CB405ABCE4BD" "C9846EE5-A715-4110-8CF9-B8DBCF5C0F1A" "6520" "C:\Program Files (x86)\Microsoft Office\Root\Office16\OUTLOOK.EXE" "WordCombinedFloatieLreOnline.onnx"
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --start-maximized --single-argument https://yesyes-cad3.powerappsportals.com/
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: C:\Program Files\Google\Chrome\Application\chrome.exe "C:\Program Files\Google\Chrome\Application\chrome.exe" --type=utility --utility-sub-type=network.mojom.NetworkService --lang=en-US --service-sandbox-type=none --mojo-platform-channel-handle=2148 --field-trial-handle=1892,i,12292628730577502130,9354259266995993712,262144 --disable-features=OptimizationGuideModelDownloading,OptimizationHints,OptimizationHintsFetching,OptimizationTargetPrediction /prefetch:8
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeProcess created: unknown unknown
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: apphelp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: c2r64.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: userenv.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: msasn1.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: kernel.appcore.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptsp.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: rsaenh.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: cryptbase.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeSection loaded: gpapi.dll
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\ClickToRun\REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{F959DBBB-3867-41F2-8E5F-3B8BEFAA81B3}\InprocServer32
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEWindow found: window name: SysTabControl32
      Source: Window RecorderWindow detected: More than 3 window changes detected
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEKey opened: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Office\Common
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk
      Source: C:\Program Files\Google\Chrome\Application\chrome.exeFile created: C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: FAILCRITICALERRORS | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeProcess information set: NOGPFAULTERRORBOX | NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information set: NOOPENFILEERRORBOX
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEFile Volume queried: C:\Windows\SysWOW64 FullSizeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXEProcess information queried: ProcessInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeQueries volume information: C:\Program Files (x86)\Microsoft Office\root\Office16\AI\WordCombinedFloatieLreOnline.onnx VolumeInformation
      Source: C:\Program Files (x86)\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\Office16\ai.exeKey value queried: HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Cryptography MachineGuid

      Mitre Att&ck Matrix

      ReconnaissanceResource DevelopmentInitial AccessExecutionPersistencePrivilege EscalationDefense EvasionCredential AccessDiscoveryLateral MovementCollectionCommand and ControlExfiltrationImpact
      Gather Victim Identity InformationAcquire InfrastructureValid AccountsWindows Management Instrumentation31
      Browser Extensions      		1
      Process Injection      		1
      Masquerading      		OS Credential Dumping1
      Process Discovery      		Remote ServicesData from Local System2
      Encrypted Channel      		Exfiltration Over Other Network MediumAbuse Accessibility Features
      CredentialsDomainsDefault AccountsScheduled Task/Job1
      DLL Side-Loading      		1
      DLL Side-Loading      		1
      Process Injection      		LSASS Memory13
      System Information Discovery      		Remote Desktop ProtocolData from Removable Media1
      Non-Application Layer Protocol      		Exfiltration Over BluetoothNetwork Denial of Service
      Email AddressesDNS ServerDomain AccountsAt1
      Registry Run Keys / Startup Folder      		1
      Registry Run Keys / Startup Folder      		1
      DLL Side-Loading      		Security Account ManagerQuery RegistrySMB/Windows Admin SharesData from Network Shared Drive2
      Application Layer Protocol      		Automated ExfiltrationData Encrypted for Impact

      Screenshots

      Thumbnails

      This section contains all screenshots as thumbnails, including those not shown in the slideshow.


      windows-stand

      Antivirus, Machine Learning and Genetic Malware Detection

      Initial Sample

      SourceDetectionScannerLabelLink
      Laurier Partners Proposal.eml0%VirustotalBrowse
      Laurier Partners Proposal.eml0%ReversingLabs

      Dropped Files

      ⊘No Antivirus matches

      Unpacked PE Files

      ⊘No Antivirus matches

      Domains

      ⊘No Antivirus matches

      URLs

      ⊘No Antivirus matches

      Domains and IPs

      Contacted Domains

      NameIPActiveMaliciousAntivirus DetectionReputation
      ripack.store
      		199.188.207.168
      		truetrue
        		unknown
        www.google.com
        		172.217.19.228
        		truefalse
          		high
          s-part-0035.t-0009.t-msedge.net
          		13.107.246.63
          		truefalse
            		high
            yesyes-cad3.powerappsportals.com
            		unknown
            		unknownfalse
              		unknown
              content.powerapps.com
              		unknown
              		unknownfalse
                		high

                Contacted URLs

                NameMaliciousAntivirus DetectionReputation
                https://yesyes-cad3.powerappsportals.com/true
                  		unknown
                  https://ripack.store/construct/sangatrue
                    		unknown

                    World Map of Contacted IPs

                    • No. of IPs < 25%
                    • 25% < No. of IPs < 50%
                    • 50% < No. of IPs < 75%
                    • 75% < No. of IPs

                    Public IPs

                    IPDomainCountryFlagASNASN NameMalicious
                    52.113.194.132
                    		unknownUnited States
                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    40.112.243.56
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    172.217.19.228
                    		www.google.comUnited States
                    		15169GOOGLEUSfalse
                    172.217.19.206
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    13.107.246.63
                    		s-part-0035.t-0009.t-msedge.netUnited States
                    		8068MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    1.1.1.1
                    		unknownAustralia
                    		13335CLOUDFLARENETUSfalse
                    172.217.17.78
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    13.89.179.14
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    172.217.17.35
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.111.252.18
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    20.42.65.85
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    239.255.255.250
                    		unknownReserved
                    		unknownunknownfalse
                    172.217.17.74
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    64.233.162.84
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    142.250.181.99
                    		unknownUnited States
                    		15169GOOGLEUSfalse
                    52.109.76.243
                    		unknownUnited States
                    		8075MICROSOFT-CORP-MSN-AS-BLOCKUSfalse
                    199.188.207.168
                    		ripack.storeUnited States
                    		22612NAMECHEAP-NETUStrue

                    Private

                    IP
                    192.168.2.16
                    192.168.2.23

                    General Information

                    Joe Sandbox version:41.0.0 Charoite
                    Analysis ID:1578697
                    Start date and time:2024-12-20 06:35:38 +01:00
                    Joe Sandbox product:CloudBasic
                    Overall analysis duration:
                    Hypervisor based Inspection enabled:false
                    Report type:full
                    Cookbook file name:defaultwindowsinteractivecookbook.jbs
                    Analysis system description:Windows 10 x64 22H2 with Office Professional Plus 2019, Chrome 117, Firefox 118, Adobe Reader DC 23, Java 8 Update 381, 7zip 23.01
                    Number of analysed new started processes analysed:15
                    Number of new started drivers analysed:0
                    Number of existing processes analysed:0
                    Number of existing drivers analysed:0
                    Number of injected processes analysed:0
                    Technologies:
                    • EGA enabled
                    Analysis Mode:stream
                    Analysis stop reason:Timeout
                    Sample name:Laurier Partners Proposal.eml
                    Detection:MAL
                    Classification:mal64.phis.winEML@18/51@16/92
                    Cookbook Comments:
                    • Found application associated with file extension: .eml

                    Warnings

                    • Exclude process from analysis (whitelisted): dllhost.exe
                    • Excluded IPs from analysis (whitelisted): 52.113.194.132, 52.109.76.243
                    • Excluded domains from analysis (whitelisted): roaming.officeapps.live.com, ecs.office.com, s-0005.s-msedge.net, osiprod-neu-buff-azsc-000.northeurope.cloudapp.azure.com, ecs.office.trafficmanager.net, prod.roaming1.live.com.akadns.net, s-0005-office.config.skype.com, eur.roaming1.live.com.akadns.net, neu-azsc-000.roaming.officeapps.live.com, ecs-office.s-0005.s-msedge.net
                    • Not all processes where analyzed, report is missing behavior information
                    • Report size getting too big, too many NtQueryAttributesFile calls found.
                    • Report size getting too big, too many NtQueryValueKey calls found.
                    • Report size getting too big, too many NtReadVirtualMemory calls found.
                    • VT rate limit hit for: yesyes-cad3.powerappsportals.com

                    Created / dropped Files

                    C:\Users\user\AppData\Local\Microsoft\FORMS\FRMCACHE.DAT

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):231348
                    Entropy (8bit):4.388257124699157
                    Encrypted:false
                    SSDEEP:
                    MD5:1DAB51593E5C3026E28BB10565D23B18
                    SHA1:D4151E3E80DE09D38AA51A0C3A5FF0B4578CBD53
                    SHA-256:5EEE0BC571D0413255D391926CE52D7B330CA4880A0AD68E0AA617971FDE2AD8
                    SHA-512:0291979A825D763271F7F4E2B728AF31E3BB5C37C079699CEAE39A302BB42B2F576146613D5A66D4C36A38F04D448727BEF0430BE4F090B64564EAB9D4D670CF
                    Malicious:false
                    Reputation:unknown
                    Preview:TH02...... . .]..R......SM01X...,...@.Q..R..........IPM.Activity...........h...............h............H..h...........m...h........P.*.H..h\cal ...pDat...h..).0.........hn.....)........h........_`Pk...h....@...I.lw...h....H...8.Uk...0....T...............d.........2h...............k_.D.....e.....!h.............. h. _..........#h....8.........$hP.*.....8....."hX$......."....'h..............1hn...<.........0h....4....Uk../h....h.....UkH..h@.).p.........-h .......4.....+h............................ ..............F7..............FIPM.Activity....Form....Standard....Journal Entry...IPM.Microsoft.FolderDesign.FormsDescription................F.k..........1122110020000000.GwwMicrosoft...This form is used to create journal entries.........kf...... ..........&...........(.......(... ...@.....................................................................................................................fffffffff........wwwwwwww.p....pp..............p...............pw..............pw..DDDDO..

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-shm

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):32768
                    Entropy (8bit):0.04562918148302959
                    Encrypted:false
                    SSDEEP:
                    MD5:CB09AA010D4172B5E52C7490A19019A9
                    SHA1:EEE65056CFC12DB79C7F7C3C3FCF33F7B9DE5B92
                    SHA-256:90EEACBA5A0F1692E70BE0B7BF27A1414AB09BCC6E57697B76D84F5CD4514A8B
                    SHA-512:8276FF8AFFA23C65433E002D4F2F0CE1AF952FD2A2C194F5EB3EE79332E904F7413B2876854ABB247D7FAF471593272E64077300F9BE830BDC3D5CBCE670FBE1
                    Malicious:false
                    Reputation:unknown
                    Preview:..-.......................R..<..(I...%...a...R..-.......................R..<..(I...%...a...R........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Office\OTele\outlook.exe.db-wal

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:SQLite Write-Ahead Log, version 3007000
                    Category:dropped
                    Size (bytes):49472
                    Entropy (8bit):0.48322324199780053
                    Encrypted:false
                    SSDEEP:
                    MD5:3A6EE0392C8C83E6E3E62ECEF297D378
                    SHA1:6C3B09392A409E4F687EF47D84016747BFE4766A
                    SHA-256:5B09C4BB23316B4B4BAADE84356529F85AC62FFE43AD6F0374AAF780BDF445DF
                    SHA-512:1BBB31A368A67ED3419237E59050E9C229BE50879D8E4AE7F9A085C9B64F7156F0528364280C4CB9A7766638D3B9FD8598805FD39A4040F0BBFF006B0455FF3F
                    Malicious:false
                    Reputation:unknown
                    Preview:7....-..........(I...%..jL;..I.........(I...%....5|2..SQLite format 3......@ .......................................................................... .............................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.MSO\E56F12C2.dat

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:PNG image data, 1022 x 746, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):88120
                    Entropy (8bit):7.843495936565491
                    Encrypted:false
                    SSDEEP:
                    MD5:BEF99F2166A2267EA47FB36741341435
                    SHA1:887B7F97E4F1D12F77A89132842D3FEA3F8324E5
                    SHA-256:9E22358E8C45F9B7096001A784CE535AB7FAE1EA3505494DBDDA9C025D62FF65
                    SHA-512:2B199282B6B4EEF3C2771D72325AE5226C86D443CBE0AD9411D81BCA35546D391347A73DB46551C92B22126B8E445D58AF23FA085DF020E72410EAFEFE1F4A42
                    Malicious:false
                    Reputation:unknown
                    Preview:.PNG........IHDR.....................iCCPICC Profile..H....TS....{..-.... ..RBh..^m.$@ ...*bC..X.*".(.(..Z.YlX.-....D..u.`C...!...{.9g2....9..g...].D".U...gK#.|.q..t.. .-..H.......B."...........<..._E./.....!....e |...<.4...!.o.(["...K...~&...$.qF..c.".......\i......KA..{...b........#..9.#AX....C....LR..rS.<..q....$".....[2D..5...S....UCz.,=3X....,..s.,0z.yY.I..Er&....V......d.."F...dA._.$K3#..&K.I.J.j..G+....".njT.$..cf+jK....a+.RY.b/.q.....>dd..w!GqovjT......b.T.8Em|...TL."^..XK".S..D...VN...l..7L..4nP.$.6.."D...B.+_.......agJ.H.)..t.r..t..g3.nok.....N<..h.g..]...?..#~ll.u.........).....i.....9.>........:.f.....X.{...7..A .D.x0..@*.@*_...*P...F..T.*......Q..Z.9p.\.7A.x.z@?x....0.A...@TH.2.L!+..bB.....E@.P"...!.......R.....B.B'.s.......B..[.....:....3`&...(x.../.s..x=\.W..F..|..{.W....H(...e.b..PT.*.%E-G...P.zT...u...B}Fc.T4.m.vG....<.B.rt...}.......E...c(.].......aR0.0..2L...."......biX.......a.bK.;....Nl.v...i.p..P....+.m........>.Ix..=...

                    C:\Users\user\AppData\Local\Microsoft\Windows\INetCache\Content.Word\~WRS{B0BE536F-8EC4-49B3-AE0D-786699398CA2}.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):3980
                    Entropy (8bit):2.915282689463852
                    Encrypted:false
                    SSDEEP:
                    MD5:06274070A403176868B228DEE19F5D6D
                    SHA1:8717E5E41DF7A99557C18B881A5CDAE22E5ABB4D
                    SHA-256:F7054916BD4D30851C579EC03E11FB488C700C7560E2484598D1A835FB4E846B
                    SHA-512:F3011F74DE02EF1B138AF26F80398B6FC70F9E3948AD0210F3E1D04424D97FC22D09377146CBF37E9C213DCD4377C011D5D49599E4AFBA919EDFEEB9B716B48A
                    Malicious:false
                    Reputation:unknown
                    Preview:....H.Y.P.E.R.L.I.N.K. .".h.t.t.p.s.:././.y.e.s.y.e.s.-.c.a.d.3...p.o.w.e.r.a.p.p.s.p.o.r.t.a.l.s...c.o.m./."...................................................................................................................................................................................................................................................................................................................................................................................................................................................B...b... ...............................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734672968965194400_0C23AED2-FDD4-4E32-B9D7-95CDD1A9215B.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:ASCII text, with very long lines (28776), with CRLF line terminators
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.17730842251163717
                    Encrypted:false
                    SSDEEP:
                    MD5:ABE27075234DADB8DF93014CABA5D02C
                    SHA1:FAAAEC0E8B4F4FBC034BB0848B2B9BF311CE307A
                    SHA-256:3EA5C34F07DFE5A67E29C5EC27A86C878DCF90D3DC6575AE73AC8C625A1FBEAA
                    SHA-512:AEE317A8F9406208DD3EF16D96BB83A6810A180F6420115A3263EA31A24DFF6A00130C4D86537A3FC5A9E28FAC84AC1C08445025C32AEDFE81CE84F760FA46EF
                    Malicious:false
                    Reputation:unknown
                    Preview:Timestamp.Process.TID.Area.Category.EventID.Level.Message.Correlation..12/20/2024 05:36:09.007.OUTLOOK (0x1978).0x1964.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.GDIAssistant.HandleCallback","Flags":30962256044949761,"InternalSequenceNumber":26,"Time":"2024-12-20T05:36:09.007Z","Contract":"Office.System.Activity","Activity.CV":"0q4jDNT9Mk6515XN0akhWw.4.11","Activity.Duration":13,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.GdiFamilyName":"","Data.CloudFontStatus":6,"Data.CloudFontTypes":256}...12/20/2024 05:36:09.023.OUTLOOK (0x1978).0x1964.Microsoft Outlook.Telemetry Event.b7vzq.Medium.SendEvent {"EventName":"Office.Text.ResourceClient.Deserialize","Flags":30962256044949761,"InternalSequenceNumber":28,"Time":"2024-12-20T05:36:09.023Z","Contract":"Office.System.Activity","Activity.CV":"0q4jDNT9Mk6515XN0akhWw.4.12","Activity.Duration":14668,"Activity.Count":1,"Activity.AggMode":0,"Activity.Success":true,"Data.JsonFileMajor

                    C:\Users\user\AppData\Local\Temp\Diagnostics\OUTLOOK\App1734672968966172700_0C23AED2-FDD4-4E32-B9D7-95CDD1A9215B.log

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):20971520
                    Entropy (8bit):0.0
                    Encrypted:false
                    SSDEEP:
                    MD5:8F4E33F3DC3E414FF94E5FB6905CBA8C
                    SHA1:9674344C90C2F0646F0B78026E127C9B86E3AD77
                    SHA-256:CD52D81E25F372E6FA4DB2C0DFCEB59862C1969CAB17096DA352B34950C973CC
                    SHA-512:7FB91E868F3923BBD043725818EF3A5D8D08EBF1059A18AC0FE07040D32EEBA517DA11515E6A4AFAEB29BCC5E0F1543BA2C595B0FE8E6167DDC5E6793EDEF5BB
                    Malicious:false
                    Reputation:unknown
                    Preview:........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Local\Temp\Outlook Logging\OUTLOOK_16_0_16827_20130-20241220T0036080722-6520.etl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:modified
                    Size (bytes):102400
                    Entropy (8bit):4.468453872599358
                    Encrypted:false
                    SSDEEP:
                    MD5:DC79EC8B08F5D04755C7B8D07BCBEED3
                    SHA1:2C01A75097FBB251074B37AA341196D331E4457F
                    SHA-256:91A068410F900E87D9982DD11AF62BB3FE6B4AEDD940DAA704A4622975F79693
                    SHA-512:7E658630E4698A44921B6785F6E1297B01CD64042E6F21E47FDFE29CF769C2A097D1996BBDB4ECE84A8F52D37C124B1AA4DCA8C24457B2E71AD30D0328CE6F8E
                    Malicious:false
                    Reputation:unknown
                    Preview:............................................................................`...d...x...?%D..R..................eJ..............Zb..2...................................,...@.t.z.r.e.s...d.l.l.,.-.1.1.2.......................................................@.t.z.r.e.s...d.l.l.,.-.1.1.1............................................................O...Y..........?%D..R..........v.2._.O.U.T.L.O.O.K.:.1.9.7.8.:.c.d.e.7.5.4.4.4.c.8.9.4.4.4.e.6.a.d.5.8.b.5.0.c.b.f.d.0.d.c.3.4...C.:.\.U.s.e.r.s.\.c.a.l.i.\.A.p.p.D.a.t.a.\.L.o.c.a.l.\.T.e.m.p.\.O.u.t.l.o.o.k. .L.o.g.g.i.n.g.\.O.U.T.L.O.O.K._.1.6._.0._.1.6.8.2.7._.2.0.1.3.0.-.2.0.2.4.1.2.2.0.T.0.0.3.6.0.8.0.7.2.2.-.6.5.2.0...e.t.l.......P.P.d...x...?%D..R..........................................................................................................................................................................................................................................................................................................

                    C:\Users\user\AppData\Roaming\Microsoft\Office\MSO3072.acl

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):30
                    Entropy (8bit):1.2389205950315936
                    Encrypted:false
                    SSDEEP:
                    MD5:0E2DF0BB9E26A787FD06F065F790412E
                    SHA1:19E34628ABA41DCCB4396334BD91183327E28FF2
                    SHA-256:5DBA85A1CC6B8DA1ADB6536D4EBD4A8A09FA3B7FAEAC67346C5BA62F0B7F0519
                    SHA-512:7A7D4A7C31D2F8775AEE72E99099DA09CE0D494CD3231DE30C333011FE6A0F8A3EF6E43420E80B42FFB73FFC961B69ADF30079441F9BCC1FED6324936E0F1337
                    Malicious:false
                    Reputation:unknown
                    Preview:....D.........................

                    C:\Users\user\AppData\Roaming\Microsoft\UProof\CUSTOM.DIC

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Unicode text, UTF-16, little-endian text, with CRLF line terminators
                    Category:modified
                    Size (bytes):14
                    Entropy (8bit):2.699513850319966
                    Encrypted:false
                    SSDEEP:
                    MD5:C5A12EA2F9C2D2A79155C1BC161C350C
                    SHA1:75004B4B6C6C4EE37BE7C3FD7EE4AF4A531A1B1A
                    SHA-256:61EC0DAA23CBC92167446DADEFB919D86E592A31EBBD0AB56E64148EBF82152D
                    SHA-512:B3D5AF7C4A9CB09D27F0522671503654D06891740C36D3089BB5CB21E46AB235B0FA3DC2585A383B9F89F5C6DAE78F49F72B0AD58E6862DE39F440C4D6FF460B
                    Malicious:false
                    Reputation:unknown
                    Preview:..c.a.l.i.....

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Docs.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 04:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2673
                    Entropy (8bit):3.9908714471473608
                    Encrypted:false
                    SSDEEP:
                    MD5:DE43854547611902942506C7000949C5
                    SHA1:6F172FA05A512C058BDE44F832AD25A5C992B5CA
                    SHA-256:B6F0922A453F594D1E128928E8923805BD747DECF11A098DD36EA5D010CCB88D
                    SHA-512:5C7720BCC2E4151F6A83EE26AA4DD2E3D742B2E6BB3CC8F67D81B219B5323169652D37E78060C64A072FF3721D9159120D77F33834E548018EDD4F1E8ABADB79
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,......6..R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Gmail.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 04:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2675
                    Entropy (8bit):4.008426798678194
                    Encrypted:false
                    SSDEEP:
                    MD5:204D96F589E048B5C20A593C95062012
                    SHA1:50160D8979B7F57E6FF0B078EE7D2491A13571D4
                    SHA-256:8168E8680A462565A34FB4A582CCA5C066E78282E96F909254C0972721A68005
                    SHA-512:A6E8D21944B80B24AB9BB137B81FD1251BD7405BB752A701FC0CC51C7C5713B3C527161F4834C7EF88DA2F13B9496D2038EB7A0BE9AB94E852C977821BD1438B
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,......*..R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Google Drive.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Oct 6 08:05:01 2023, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2689
                    Entropy (8bit):4.013591461813927
                    Encrypted:false
                    SSDEEP:
                    MD5:F218395DF7AE31E9FCDEF20AB30D9733
                    SHA1:FBED0472799C58889932E37EAC4B5728981BB7D1
                    SHA-256:58DEB0EFF7B246B0575A38D35257D613CB045AC79A10DA5EE3A70C322F2A7C58
                    SHA-512:CF0463453531D8101AF7C067A2093F532847DF3506F1CBA69B689CDC0BD0B2035EF6C0C9F2EC85A143A1A294F0F5E3724DC26EEEDD4220AE43EB7A8FBE2A2538
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....Y.04...N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.VFW.E...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Sheets.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 04:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):4.003384999921152
                    Encrypted:false
                    SSDEEP:
                    MD5:43B933AA6EF3135C760F7BEDF04B6B0E
                    SHA1:E33D308340D0194AFC39CD9555906F0041A86C2D
                    SHA-256:1CFEEF2A57A7D51507EA6EA3614768E5E0A5EF7489BDD73538AC0953B6DC9C76
                    SHA-512:553A255EFF252B51BF12D81835CC71C6641DCD614B313C5100B238021EAF39E408DF79D6D9526FF755F0BA3CF172F20DD60E049B3EB45AF09C5C9F5BB28A9DD2
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....gF#..R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\Slides.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 04:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2677
                    Entropy (8bit):3.9928513782690516
                    Encrypted:false
                    SSDEEP:
                    MD5:1B4EDD5D6B074B76D0FC78154E4B9852
                    SHA1:32E5D8774DC83BED5166C92DCB9537ED4238E08B
                    SHA-256:6E42CAE90014027585F353928C96A7F3E19C9D80BC9736D71D8F6BBE320BD14A
                    SHA-512:21089C727DA5F4B708BBB7BE37B787D27A4E4540FCC6250AB91F45C4199D001AF7AD8BAF1763E42AD43662729DF1CC7DB38C4439C28DF52E58E6F86A284230BC
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,.....(1..R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Chrome Apps\YouTube.lnk

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:MS Windows shortcut, Item id list present, Points to a file or directory, Has Relative path, Has Working directory, Has command line arguments, Icon number=0, Archive, ctime=Tue Oct 3 09:48:42 2023, mtime=Fri Dec 20 04:36:18 2024, atime=Wed Sep 27 04:28:28 2023, length=1210144, window=hide
                    Category:dropped
                    Size (bytes):2679
                    Entropy (8bit):4.000158592060332
                    Encrypted:false
                    SSDEEP:
                    MD5:A11AFE515D8C650DF99B3EF5024F82EE
                    SHA1:EE4776BE65DD6B944E20B6825343783DDF9988A0
                    SHA-256:A18093425F7B9C5BD8AF4A083BC54DBAE9AE9B4EE9A352518691FC862BCD249F
                    SHA-512:E73034450D1CEB8C10740DB2E0497AC2F82D8279A1875339DCF4DC4A8D050D974C8C030ED17B64F7C1BB497F00942A365D3EF0EA550132C19CDB399AEA87B86B
                    Malicious:false
                    Reputation:unknown
                    Preview:L..................F.@.. ...$+.,....t....R..N.Yr.... w......................1....P.O. .:i.....+00.../C:\.....................1.....FW.J..PROGRA~1..t......O.I.Yy,....B...............J.........P.r.o.g.r.a.m. .F.i.l.e.s...@.s.h.e.l.l.3.2...d.l.l.,.-.2.1.7.8.1.....T.1.....CW.V..Google..>......CW.V.Y.,....L.....................p+j.G.o.o.g.l.e.....T.1.....CW.V..Chrome..>......CW.V.Y.,....M......................8..C.h.r.o.m.e.....`.1.....CW.V..APPLIC~1..H......CW.V.Y.,..........................."&.A.p.p.l.i.c.a.t.i.o.n.....n.2. w..;W.+ .CHROME~1.EXE..R......CW.V.Y.,...........................H..c.h.r.o.m.e._.p.r.o.x.y...e.x.e.......j...............-.......i............d.......C:\Program Files\Google\Chrome\Application\chrome_proxy.exe..S.....\.....\.....\.....\.....\.....\.....\.....\.....\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.\.c.h.r.o.m.e._.p.r.o.x.y...e.x.e.*.C.:.\.P.r.o.g.r.a.m. .F.i.l.e.s.\.G.o.o.g.l.e.\.C.h.r.o.m.e.\.A.p.p.l.i.c.a.t.i.o.n.F

                    C:\Users\user\Documents\Outlook Files\Outlook Data File - NoEmail.pst

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:Microsoft Outlook email folder (>=2003)
                    Category:dropped
                    Size (bytes):271360
                    Entropy (8bit):4.72717903786791
                    Encrypted:false
                    SSDEEP:
                    MD5:9070FC2D2BD60FDA61C57B3732EA1A46
                    SHA1:D7CC224754E7D9A5B139828F97C851CE2587A3FF
                    SHA-256:6ECBB39282D6D7D7D724A1CAF0E79DD3E595E98B17D5EE5EC662131241809B8F
                    SHA-512:1102659E25E492E2A393D78469B597BA8D1200C032516B36AB44FD6346D25F98EEAE52D9200C904315CBED481EE2B530CA0173CBD19DD0C973C8EF1D10300857
                    Malicious:true
                    Reputation:unknown
                    Preview:!BDN:..@SM......\.......................\................@...........@...@...................................@...........................................................................$.......D...............................R............................................................................................................................................................................................................................................................................................................|.........................................................................................................................................................................................................................................................................................................................................................................................................................................................................................

                    C:\Users\user\Documents\Outlook Files\~Outlook Data File - NoEmail.pst.tmp

                    Download File
                    Process:C:\Program Files (x86)\Microsoft Office\root\Office16\OUTLOOK.EXE
                    File Type:data
                    Category:dropped
                    Size (bytes):262144
                    Entropy (8bit):4.756647223927137
                    Encrypted:false
                    SSDEEP:
                    MD5:5FA0818DBF615CE0BD536C841D863C6A
                    SHA1:7B07575E47E757406AE25C72517588FB687D54F5
                    SHA-256:9547096DD9A6E3F92119E1F7B1CAA207070195E386E50C882DC390CD6ACE5E95
                    SHA-512:14392B84EE8D8E78BB6DBA61EE4D0C31ECA23100605DEF3A44CC0654C2514CB3254B474AE8D8EF766B1D8E60D10C012F189D0B7BF1E50997D05EF08C7830BE98
                    Malicious:true
                    Reputation:unknown
                    Preview:...%C...a.......x..../...R....................#.!BDN:..@SM......\.......................\................@...........@...@...................................@...........................................................................$.......D...............................R............................................................................................................................................................................................................................................................................................................|....../...R.......B............#.........................................................................................................................................................................................................................................................................................................................................................................................................

                    Chrome Cache Entry: 104

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 text, with CRLF line terminators
                    Category:downloaded
                    Size (bytes):30199
                    Entropy (8bit):5.084288947442727
                    Encrypted:false
                    SSDEEP:
                    MD5:3030AEDCB4F044B0CC4A2E3B6DF00259
                    SHA1:C74BAC96C68691D53E781054B0F83A4581F16E95
                    SHA-256:408F15E5BC6FF761D8AB50C8D3D318E4F9EB16A3E99E576EBC688CB4FC411634
                    SHA-512:D5A2B2F790AB25FF25BE32591B61413DB6143DFDD8A150A0869D73187BD5836475A18B9597013A1ADFF39EBBB601CE6F7E9D0E1479B695B8BAA0E4F062D729E1
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/_portal/a63ab577-516f-49f8-99f1-2b218b9f3a7a/Resources/ResourceManager?lang=en-US
                    Preview:....window.ResourceManager = {.. 'Cms_Sitemapchildren_Update_Label' : "Children", .. 'EntityGrid_Url_NotFound' : "A required service URL wasn\u0027t provided.",.. 'FileBrowser_Header_Label' : "Choose a file.",.. 'ADX_EventSchedule_AcceptableDays' : "Acceptable days",.. 'Confirm_DeleteMultiple_Entity' : "Are you sure you want to delete these records?",.. 'ADX_Blog_ShortName' : "blog",.. 'ADX_BlogPost_ShortName' : "blog post",.. 'Entity_Create_ADX_BlogPost_Label' : "Blog post",.. 'Entity_Create_ADX_Blog_Label' : "Child blog",.. 'Entity_Create_ADX_Event_Label' : "Child event",.. 'Entity_Create_ADX_CommunityForum_Label' : "Child forum",.. 'Editable_DeleteMultiple_Tooltip_Suffix_Singular' : "Child record?",.. 'Editable_DeleteMultiple_Tooltip_Suffix_Plural' : "Child records?",.. 'Entity_Create_ADX_Shortcut_Label' : "Child shortcut",.. 'ADX_BlogPostComment_ShortName' : "comment",.. 'ADX_PageComment_ShortName' : "comment",... 'Entity_Create_ADX_BlogPost_Tooltip' : "Create a new blog post",..

                    Chrome Cache Entry: 107

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (11766), with no line terminators
                    Category:downloaded
                    Size (bytes):11766
                    Entropy (8bit):4.903164552389703
                    Encrypted:false
                    SSDEEP:
                    MD5:2659C6F064BBDF38AFF3A3F7D33BA256
                    SHA1:73EA787E226F755D9F57DC637AEB5A9D506338CF
                    SHA-256:E3A5A5E3432453A9CDCE2A02DD4D7F08037119C6A9AC545D010D3CF73768825A
                    SHA-512:F2508AE13D0E19E3BA856F919E05FCF731A2481C13D2FF99FB7843E7CA7CEAA37BE37D07E20C18CFDFE09A4B2DB9EA196A9C179B201C37C85A9F8146FF18D173
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/pcf-style.bundle-2659c6f064.css
                    Preview:.msos-open .msos-inner-container:not(.msos-fullscreen) .msos-selection-container{position:absolute!important;z-index:1000;top:28px!important}html[dir=rtl] .msos-open .msos-inner-container:not(.msos-fullscreen) .msos-selection-container{right:0!important}html[dir=ltr] .msos-open .msos-inner-container:not(.msos-fullscreen) .msos-selection-container{left:0!important}.msos-glyph:after{font-size:9px!important}.msos-label{margin-bottom:0}.msos-caret-button:focus{outline:0}.msos-selecteditems-container:focus{outline:0}.msos-container:not(.msos-disabled){border:1px solid #949494;box-shadow:inset 0 1px 1px rgb(0 0 0 /8%);transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s}.msos-container:not(.msos-disabled).msos-active{border:1px solid #949494!important;box-shadow:inset 0 1px 1px rgb(0 0 0 /8%);transition:border-color ease-in-out .15s,box-shadow ease-in-out .15s}.msos-container:not(.msos-disabled).msos-focused{border-color:#69c!important;outline:0;box-shadow:inset 0 1px 1px rgb

                    Chrome Cache Entry: 108

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with no line terminators
                    Category:downloaded
                    Size (bytes):16
                    Entropy (8bit):3.452819531114783
                    Encrypted:false
                    SSDEEP:
                    MD5:CD598D2DCE38CFBA2981425AFD8CC5FF
                    SHA1:56C8577B18B89C77A6AC58B925F8ECAB11BEF02C
                    SHA-256:64BC0BCC655408713CCC3195B859007631C335758AAC8575658AC138509233E8
                    SHA-512:61797961E4747CA9CD7B3E6746E5243F7D9EF59B21B27911E974CEB68460C71ED438FEAAE6C7E1BC77A50E687D63A26623DB0AC1204DEAC60D094EFD0271C6FA
                    Malicious:false
                    Reputation:unknown
                    URL:https://content-autofill.googleapis.com/v1/pages/ChVDaHJvbWUvMTE3LjAuNTkzOC4xMzISEAnxM-LB8N2aHhIFDa8aOOA=?alt=proto
                    Preview:CgkKBw2vGjjgGgA=

                    Chrome Cache Entry: 109

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 (with BOM) text, with CRLF line terminators
                    Category:downloaded
                    Size (bytes):4807
                    Entropy (8bit):4.941343369031878
                    Encrypted:false
                    SSDEEP:
                    MD5:633E70F51B5C0319AF3ACF16EC1AE7B6
                    SHA1:D28238721914C98998ACC0485CCEBF230F01A520
                    SHA-256:FB076F7948CA70EB1F51334FE4C473C40BBE3BCEB105981C482BB8634FF98081
                    SHA-512:1509681E13367F0264CC341C1752B9EF7FFE0714098615282DB2B3688C24AF50D1052421DD606FCFCF942C0BE2D59B7694FA59150923F427FCD807530C56998A
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/client-telemetry-wrapper.bundle-633e70f51b.js
                    Preview:.//// Wrapper class for client logger for below purposes..//// 1. Abstracting CST framework code from manual trace log APIs. ..//// 2. Constrolling instantiation of CST framework code in clientLogger.js based on whether telemetry is enabled..class ClientLogWrapper {...../// Constructor which also creates an instance of actual logger if telemetry is enabled...constructor() {....try {.....if (Helper.isTelemetryEnabled()) {......ClientLogger.getLogger();.....}....}....catch (exception) {.....console.warn(exception);....}...}...../// Gets the client log wrapper. Creates new instance if not already created...static getLogger() {....if (!window.clientLogWrapper) {.....window.clientLogWrapper = new ClientLogWrapper();....}......return window.clientLogWrapper;...}...../// Trace info log.../// For component, subComponent, action, tag, it is recommended to use standard short and crisp one worder string..../// Examples:.../// for component: entity_grid, entity_form etc.../// For SubComponent: f

                    Chrome Cache Entry: 110

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (39862)
                    Category:downloaded
                    Size (bytes):977847
                    Entropy (8bit):5.3506013175263405
                    Encrypted:false
                    SSDEEP:
                    MD5:E303D5355313048BECBD7E9429825F82
                    SHA1:4ECFDB3DCA8F4AD156D0A0F12FB2ABBB1DBF6D67
                    SHA-256:CED5EA5C04E6DD8807FA46B2052888EB4798E557C507FC2EC75463FEE17A9AEA
                    SHA-512:2DD6CFF9B75FE25F1000CDC54F63209D11E9E90860F8CE23A492E1AFA28A7ADDB8E5262031BFF3772174F001ABFD19A5FD655AC562E4297667C8F4DA26B71AC7
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/pcf-extended.bundle-e303d53553.js
                    Preview:var __assign=this&&this.__assign||function(){return(__assign=Object.assign||function(e){for(var t,n=1,o=arguments.length;n<o;n++)for(var r in t=arguments[n])Object.prototype.hasOwnProperty.call(t,r)&&(e[r]=t[r]);return e}).apply(this,arguments)};!function(e,t){"object"==typeof exports&&"object"==typeof module?module.exports=t(require("React"),require("Fela")):"function"==typeof define&&define.amd?define("ReactFela",["React","Fela"],t):"object"==typeof exports?exports.ReactFela=t(require("React"),require("Fela")):e.ReactFela=t(e.React,e.Fela)}(window,function(n,o){return function(n){var o={};function r(e){if(o[e])return o[e].exports;var t=o[e]={i:e,l:!1,exports:{}};return n[e].call(t.exports,t,t.exports,r),t.l=!0,t.exports}return r.m=n,r.c=o,r.d=function(e,t,n){r.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:n})},r.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:

                    Chrome Cache Entry: 111

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (48395)
                    Category:downloaded
                    Size (bytes):48444
                    Entropy (8bit):5.284267981780026
                    Encrypted:false
                    SSDEEP:
                    MD5:6027D51DC3F9461C3B5AB3A1F8C5BEED
                    SHA1:9787028F6B186F85580729694A1ED66DAE58B5F5
                    SHA-256:C108037861ED8A7BD3CD188CC6DA3F7DC4103207B2C77B7E439F33DFA9334309
                    SHA-512:59D2F7FA229810027D9D82AFC1FB17FE20FE5172E596C204D274B65E5CA887A6FD4F9736787EE1413ACA4F7324198183FAB2F0D41D9889D3F0902E905A14B894
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/controls/host/448.462407f435.chunk.js
                    Preview:(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[448],{9448:(t,e,r)=>{"use strict";function n(t){for(var e=arguments.length,r=Array(e>1?e-1:0),n=1;n<e;n++)r[n-1]=arguments[n];throw Error("[Immer] minified error nr: "+t+(r.length?" "+r.map((function(t){return"'"+t+"'"})).join(","):"")+". Find the full error at: https://bit.ly/3cXEKWf")}function o(t){return!!t&&!!t[V]}function i(t){var e;return!!t&&(function(t){if(!t||"object"!=typeof t)return!1;var e=Object.getPrototypeOf(t);if(null===e)return!0;var r=Object.hasOwnProperty.call(e,"constructor")&&e.constructor;return r===Object||"function"==typeof r&&Function.toString.call(r)===J}(t)||Array.isArray(t)||!!t[Y]||!!(null===(e=t.constructor)||void 0===e?void 0:e[Y])||p(t)||h(t))}function a(t,e,r){void 0===r&&(r=!1),0===u(t)?(r?Object.keys:X)(t).forEach((function(n){r&&"symbol"==typeof n||e(n,t[n],t)})):t.forEach((function(r,n){return e(n,r,t)}))}function u(t){var e=t[V];return e?e.i>3?e.i-4

                    Chrome Cache Entry: 112

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:gzip compressed data, max compression, from TOPS/20, original size modulo 2^32 220715
                    Category:downloaded
                    Size (bytes):79435
                    Entropy (8bit):7.995978696659151
                    Encrypted:true
                    SSDEEP:
                    MD5:20ABD95082F377B19DA17651500BF0D1
                    SHA1:010531E7E691E689E79FC34906769FAF2BF11C12
                    SHA-256:37ED7BF95AADD9BF9078826A0C7223F36B14F027444AAFDDE60D3639592EE0ED
                    SHA-512:D83E280FAE6D5D293DAD204C4493F25C9CF51527B1E1A8473C50331CEE83FC799F1D6747AEAA3048A50C9C61A1B7C6F505443AEBB250274435F75EA53F699B9F
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/dist/client-telemetry.bundle-c71b2e2d47.js
                    Preview:............ys.H./..........%...6(.C.d[..X.76G..E.........g...*....3..i.@m.%+...z.G.........I..I.d.cm+.G.Y.....B.V.+.W\f;.?$..UV......I....G.Z.GY.^L.8I.....%.Z"S...A....Z{Q&..T.0.=8.}.......]....$..0...y.&.... .:(5.<...g..?%...I4..0..z..q.gq.0...y....EGI<.I.`.K.k.[.7....ix..Sz...gRHzTm.5.w.....MF.N..-.G........A.E...I:].u/:..&IT.4.....xX......f..yC.-.].<=.R...=.....0..wy.z+sUk.K.Q.C.....b.'.Ev..w.H..N..n...%...Q.k...:.R..Q...S..|d...KK..L..NlK.|.X...P...j......].A..hq<)..).;......i..S.y.ps..D.p,.#j.a..{xz*..:?....D.E.....FFY....2..D.a'j4..`R..ZV..E}.`......D.,-......8.BO.]..Rd.....R...Sp8.uy<?.99?w{.i.......$....d.(.eS....;.~;.u.v..1B...S...rR.tes..'...i.N....u..E...Wv{D{.&.3....?.....V-LkQL8.f.U..P.r...ZH...#/..............?...k.Zfz..uuf9EBK.W)...g..Fa....7a./...7....ev.g..a.2..[*8 ......CB4.....)=.+. ...h....._.:........../....h.......YY.o_3..d...Z....H%...6!_........e.p.....-.)3.7.\..I.i.....(..s..).L-qK.q...G2..]I...2$.|C

                    Chrome Cache Entry: 113

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (28287)
                    Category:downloaded
                    Size (bytes):856286
                    Entropy (8bit):5.353180762698638
                    Encrypted:false
                    SSDEEP:
                    MD5:9183DA3D63ADCBCA9C451BB60E6E1F10
                    SHA1:9207557A291A137EF495DCEF25900E1E5D6F33AA
                    SHA-256:66AA8F2E328C6461928C45E81A225A7C857185A6A27119BEBFD3F3C321AD555C
                    SHA-512:4E2E8A538841E68A4ED206E324A9896A76EE678D0A4F36EE322786A46149EE4B3271A30262AAFD4713DD4C24AD34FD454BE114460169535A86455DCF891EAE62
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/pcf.bundle-9183da3d63.js
                    Preview:!function(n){var r={};function o(e){if(r[e])return r[e].exports;var t=r[e]={i:e,l:!1,exports:{}};return n[e].call(t.exports,t,t.exports,o),t.l=!0,t.exports}o.m=n,o.c=r,o.d=function(e,t,n){o.o(e,t)||Object.defineProperty(e,t,{enumerable:!0,get:n})},o.r=function(e){"undefined"!=typeof Symbol&&Symbol.toStringTag&&Object.defineProperty(e,Symbol.toStringTag,{value:"Module"}),Object.defineProperty(e,"__esModule",{value:!0})},o.t=function(t,e){if(1&e&&(t=o(t)),8&e)return t;if(4&e&&"object"==typeof t&&t&&t.__esModule)return t;var n=Object.create(null);if(o.r(n),Object.defineProperty(n,"default",{enumerable:!0,value:t}),2&e&&"string"!=typeof t)for(var r in t)o.d(n,r,function(e){return t[e]}.bind(null,r));return n},o.n=function(e){var t=e&&e.__esModule?function(){return e.default}:function(){return e};return o.d(t,"a",t),t},o.o=function(e,t){return Object.prototype.hasOwnProperty.call(e,t)},o.p="",o(o.s=18)}({18:function(e,t,n){n(19).polyfill()},19:function(e,t,n){"use strict";function r(e,t){if

                    Chrome Cache Entry: 119

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 10 x 10, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):237
                    Entropy (8bit):6.43867499964275
                    Encrypted:false
                    SSDEEP:
                    MD5:74710B068526106916E5A9AE5B70FA64
                    SHA1:2E7344458A5EB6EFB65976EE144BBEDBA680B5AC
                    SHA-256:55B9B171BB9BC15ACDD21C7A186E1268BC774B6A7C5A6FBC2F2BFEE564890325
                    SHA-512:6D66F49A52C8A4E0EEB0C4F67DC85CAFEE5C2F8716E8E80EB5BE6C266F4E7CFC161EA5B0937A383BA13B1DD5B97742D70FA9630A502F87BE622FF0512BA63047
                    Malicious:false
                    Reputation:unknown
                    Preview:.PNG........IHDR..............2.....pHYs.................sRGB.........gAMA......a.....IDATx...... ...(./K vd........v........!.`?p.......]'g.."...,6%..`gC..%`s.$"..<...=....e..4X.._kQ...e..h.-.}...3=.e/.D..C....ob41.x.....IEND.B`.

                    Chrome Cache Entry: 120

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 (with BOM) text, with very long lines (13123), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):13687
                    Entropy (8bit):4.882216091465932
                    Encrypted:false
                    SSDEEP:
                    MD5:3D8A58A48F40F6564C3F3668EEEE91A0
                    SHA1:0A99CC0043999807F879C16B1BECD13F36F71A56
                    SHA-256:31AD9CA96F5261E21E4EE2074153533E62A39AF0F1EBFA5B65F3B24F7F3CCC4A
                    SHA-512:C18DA8EE82005308B6037925298C53F838829ABB7392026FB3765AD430B59CD1E919AECB7280BAE39A8B4476D03D084F10FE54F8A427B5E4DBC6FB29FEBC82C3
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/font-awesome.bundle-3d8a58a48f.css
                    Preview:..fa{position:relative;top:1px;display:inline;font-family:'Glyphicons Halflings';font-style:normal;font-weight:400;line-height:1;-webkit-font-smoothing:antialiased;-moz-osx-font-smoothing:grayscale}.fa-lg{font-size:1.33333em;line-height:0.75em;vertical-align:-15%}.fa-2x{font-size:2em}.fa-3x{font-size:3em}.fa-4x{font-size:4em}.fa-5x{font-size:5em}.fa-fw{width:1.28571em;text-align:center}.fa-ul{padding-left:0;margin-left:2.14285714em;list-style-type:none}.fa-ul>li{position:relative}.fa-li{position:absolute;left:-2.14285714em;width:2.14285714em;top:0.14285714em;text-align:center}.fa-li.fa-lg{left:-1.85714286em}.fa-border{padding:.2em .25em .15em;border:solid 0.08em #eeeeee;border-radius:.1em}.fa.pull-left{float:left;margin-right:.3em}.fa.pull-right{float:right;margin-left:.3em}.fa-spin{-webkit-animation:fa-spin 2s infinite linear;animation:fa-spin 2s infinite linear}.fa-pulse{-webkit-animation:fa-spin 1s infinite steps(8);animation:fa-spin 1s infinite steps(8)}@-webkit-keyframes fa-spin

                    Chrome Cache Entry: 121

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (352), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):22704
                    Entropy (8bit):5.095523717383364
                    Encrypted:false
                    SSDEEP:
                    MD5:0BFBE4560787D9B36478E78E85DCC335
                    SHA1:0196FEFA9D6CFA29AE7C6DB281EAA8E5D18DF73C
                    SHA-256:93CC26A0C8538C378CD1E4D2D45075B29CC1DF7632D2D36A5D0AA22D14D84AA2
                    SHA-512:3C221638232D07ABB67C1D2FE9BF15B1D7EAD5EAA30C23D72BB92894F078C2518E5CBD51D2C7EFDD76ED481BF5C280D53763864B781F45AFCD4099251809EBA7
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/portalbasictheme.css
                    Preview:/**.. * Code generated by Microsoft. Changes to this file are not.. * supported. We recommend that you do not modify this file. Any.. * change to this file will get overwritten with a theme applied using.. * Site Styling panel from Power Apps Portals... */.. :root {.. --portalThemeColor1: #2E456B;.. --portalThemeColor2: #FFCA4B;.. --portalThemeColor3: #277493;.. --portalThemeColor4: #FEA002;.. --portalThemeColor5: #F3DBB1;.. --portalThemeColor6: #88ABA2;.. --portalThemeColor7: #FFFFFF;.. --portalThemeColor8: #2A2C2E;.. --portalThemeColor9: #E58700;.. --portalThemeColor10: ;.. --portalThemeColor11: ;.. --portalThemeColor12: ;.. --portalThemeOnColor1: #FFFFFF;.. --portalThemeOnColor2: #2A2C2E;.. --portalThemeOnColor3: #FFFFFF;.. --portalThemeOnColor4: #2A2C2E;.. --portalThemeOnColor5: #2A2C2E;.. --portalThemeOnColor6: #2A2C2E;.. --portalThemeOnColor7: #2A2C2E;.. --portalThemeOnColor8: #FFFFFF;.. --portalThemeOnColor9: #2A2C2E;.. --portalThemeOnColor10: ;.. --portal

                    Chrome Cache Entry: 122

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (61300)
                    Category:dropped
                    Size (bytes):164673
                    Entropy (8bit):5.5275808716689285
                    Encrypted:false
                    SSDEEP:
                    MD5:184C77DA50998ED29B32136A393D3A3D
                    SHA1:B7977B0078AB08A7C3B1E58DFA8942CBF609F471
                    SHA-256:E031F7BA25B1896ABE9459E418284BB862325453675EF7C27E6070BD6A538631
                    SHA-512:5F1DEF511EC6EC8E92158F32ADA2443948F0939421FA6472CC14F67755DCE345B1D05068E83523B20ECCF6E14863223DF661051404FE0969864C3DA16D63FE30
                    Malicious:false
                    Reputation:unknown
                    Preview:(function(e,a){var r=[];function n(t,r){var n=a.Deferred();(function e(){a.ajax(t).done(n.resolve).fail(function(){console.log("AjaxRetry attempt :".concat(r));r--;if(r>0){e()}else{n.rejectWith(this,arguments)}})})();return n.promise()}function t(){var e=a.Deferred();var t=a('#antiforgerytoken input[name="__RequestVerificationToken"]').val();if(!t){r.push(e);if(r.length===1){n({type:"GET",url:a("#antiforgerytoken").attr("data-url"),cache:false},3).done(function(e){a("#antiforgerytoken").empty().append(e);t=a('#antiforgerytoken input[name="__RequestVerificationToken"]').val();r.forEach(function(e){e.resolve(t)});r=[]}).fail(function(e){if(e&&e.responseText){var t="GetAntiForgeryToken failed".concat("Details: ",e.responseText);console.log(t);ClientLogWrapper.getLogger().traceError(t,"antiforgerytoken","","GetTokenDeferred")}r.forEach(function(e){e.reject()});r=[]})}}else{e.resolve(t)}return e.promise()}function i(){var e=a("#antiforgerytoken").attr("data-url");n({type:"GET",url:e,cache:f

                    Chrome Cache Entry: 124

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 1476 x 574, 8-bit/color RGBA, non-interlaced
                    Category:downloaded
                    Size (bytes):229949
                    Entropy (8bit):7.970123220907809
                    Encrypted:false
                    SSDEEP:
                    MD5:9AD944B84F4528F590619B60770A1894
                    SHA1:26F7E3F6883159EEBF8E974F0CE9F7E9D7D6E013
                    SHA-256:1266ABC1265E9704A9A9493FC3AAF5D2B049617722277CF50365985C757F40A5
                    SHA-512:B31DFF4FBEE32980928DD3C442B37E13455EF66A0AE70D0831F95369BCC8CFB3DE21489BEC6F5B56818B51BF4FF1664306D5AC233DE801CA9E006A9912448EE6
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/Screenshot%202024-11-04%20at%201.31.45%E2%80%AFPM.png
                    Preview:.PNG........IHDR.......>......g......iCCPICC Profile..H....TS....{..-.... ..RBh..^m.$@ ...*bC..X.*".(.(..Z.YlX.-....D..u.`C...!...{.9g2....9..g...].D".U...gK#.|.q..t.. .-..H.......B."...........<..._E./.....!....e |...<.4...!.o.(["...K...~&...$.qF..c.".......\i......KA..{...b........#..9.#AX....C....LR..rS.<..q....$".....[2D..5...S....UCz.,=3X....,..s.,0z.yY.I..Er&....V......d.."F...dA._.$K3#..&K.I.J.j..G+....".njT.$..cf+jK....a+.RY.b/.q.....>dd..w!GqovjT......b.T.8Em|...TL."^..XK".S..D...VN...l..7L..4nP.$.6.."D...B.+_.......agJ.H.)..t.r..t..g3.nok.....N<..h.g..]...?..#~ll.u.........).....i.....9.>........:.f.....X.{...7..A .D.x0..@*.@*_...*P...F..T.*......Q..Z.9p.\.7A.x.z@?x....0.A...@TH.2.L!+..bB.....E@.P"...!.......R.....B.B'.s.......B..[.....:....3`&...(x.../.s..x=\.W..F..|..{.W....H(...e.b..PT.*.%E-G...P.zT...u...B}Fc.T4.m.vG....<.B.rt...}.......E...c(.].......aR0.0..2L...."......biX.......a.bK.;....Nl.v...i.p..P....+.m........>.Ix..=...

                    Chrome Cache Entry: 126

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:HTML document, ASCII text, with very long lines (2044)
                    Category:dropped
                    Size (bytes):4233
                    Entropy (8bit):5.181313852923847
                    Encrypted:false
                    SSDEEP:
                    MD5:7E882E84934F26C4A7F2531D9D68F4A6
                    SHA1:045ADE5B048BBDDFFE22E42FA7551CEC8DBD64A0
                    SHA-256:D2FD30E73B65AC72EF27CFDF24CE2AC8D9A7AD67CF9B8316077E74D487E0B461
                    SHA-512:25BCC7003EC50E7D139C477F90F2B82362A6CB204179DE441D5EC409C2D5E59F03A0466EB014E3EEFDFF2719429D641DF6648FE4842F41DD22929593F032B121
                    Malicious:false
                    Reputation:unknown
                    Preview:<html>. <head>. <title>COMING SOON</title>. <body>. <div class="bgimg">. <div class="middle">. <h1>COMING SOON</h1>. <hr>. <p id="demo" style="font-size:30px"></p>. </div>. </div>. <style>. body,. html {. height: 100%;. margin: 0;. }.. .bgimg {. background-image: url("https://i.imgur.com/xA8aaXN.png");. height: 100%;. background-position: center;. background-size: cover;. position: relative;. color: white;. font-family: "Courier New", Courier, monospace;. font-size: 25px;. }.. .topleft {. position: absolute;. top: 0;. left: 16px;. }.. .bottomleft {. position: absolute;. bottom: 0;. left: 16px;. }.. .middle {. position: absolute;. top: 80%;. left: 50%;. transform: translate(-50%, -50%);. text-align: center;. }.. hr {. margin: auto;.

                    Chrome Cache Entry: 127

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with no line terminators
                    Category:downloaded
                    Size (bytes):80
                    Entropy (8bit):4.509183719779188
                    Encrypted:false
                    SSDEEP:
                    MD5:F4A0E619B855697F4DB1A1B22FE37E8C
                    SHA1:3D1CA30185839E05C6D876C7E8477604BFAC6CDA
                    SHA-256:CEC86F53B19C31BC124614007553A6EBC5434F9B1D2F03B1DB0393B22AB16EA2
                    SHA-512:8FF46BF8D3B93DA72109C92A26D5FF4C8E16FD6CD98FBB0E6A9E7E31E55220E8B2D71B851219199DF9C6D2074137192F55F84B4B89AF9C4C4D1B9D6FDB94EFC5
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/pcf-loader.bundle-f4a0e619b8.js
                    Preview:$(()=>{if(window.loadAllPcfControlsOnPage){window.loadAllPcfControlsOnPage()}});

                    Chrome Cache Entry: 129

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 text, with very long lines (387), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):159279
                    Entropy (8bit):4.98674872017534
                    Encrypted:false
                    SSDEEP:
                    MD5:CC9AC2928CA92A074A4D030AA0A7CF47
                    SHA1:7FA7E41EDF7BAAD566425038BDA364A32BF7A18A
                    SHA-256:2070FCFFEFB64A1E7B163E157187B3F0B69D9C03AD8BB84EDD13D7CB639FF20B
                    SHA-512:EC5B9A3D4D0C3DD5582D74E1913BA0B8DF0EBCBCEE1AE5A3870188F6206F137E96330AE0EF968718BA6EE0B35D1F1384DBBD567B4936F9A444AE2B5574C428CD
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/bootstrap.min.css
                    Preview:/*!.. * Bootstrap v3.3.6 (http://getbootstrap.com).. * Copyright 2011-2015 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */....../*! normalize.css v3.0.3 | MIT License | github.com/necolas/normalize.css */....article,..aside,..details,..figcaption,..figure,..footer,..header,..hgroup,..main,..menu,..nav,..section,..summary {.. display: block..}....audio,..canvas,..progress,..video {.. display: inline-block;.. vertical-align: baseline..}....audio:not([controls]) {.. display: none;.. height: 0..}....[hidden],..template {.. display: none..}....a {.. background-color: transparent..}....a:active,..a:hover {.. outline: 0..}....abbr[title] {.. border-bottom: 1px dotted..}....b,..strong {.. font-weight: bold..}....dfn {.. font-style: italic..}....h1 {.. font-size: 2em;.. margin: .67em;.. font-weight: bold;..}....mark {.. background: #ff0;.. color: #000..}....small {.. font-size: 80%..}....sub,..s

                    Chrome Cache Entry: 130

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (64632), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):108347
                    Entropy (8bit):5.048987215271787
                    Encrypted:false
                    SSDEEP:
                    MD5:07636D960562CF64047794C1D2147A0B
                    SHA1:0BCFFC6C84C6F493F99D3E33380207A40CB3612B
                    SHA-256:0327392292F6156C374969DFCF06F19C40914F414E201792D20A81B7D2EB9A90
                    SHA-512:09C7463AB26D04302307D286A528FD5F4C2AEC8588A7A4EEDCE0F7BC0D0E59A3FB8F3FB2E65A23D222E7A9051CA359DE3C58605883BD7B318FA36C3139778C91
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/preform.bundle-07636d9605.css
                    Preview:.prettyprint{padding:8px;background-color:#f7f7f9;border:1px solid #e1e1e8}.prettyprint[class*=linenums]{-webkit-box-shadow:inset 40px 0 0 #fbfbfc,inset 41px 0 0 #ececf0;-moz-box-shadow:inset 40px 0 0 #fbfbfc,inset 41px 0 0 #ececf0;box-shadow:inset 40px 0 0 #fbfbfc,inset 41px 0 0 #ececf0}.prettyprint .com{color:#93a1a1}.prettyprint .lit{color:#195f91}.prettyprint .clo,.prettyprint .opn,.prettyprint .pun{color:#93a1a1}.prettyprint .fun{color:#dc322f}.prettyprint .atv,.prettyprint .str{color:#d14}.prettyprint .kwd,.prettyprint .tag{color:#1e347b}.prettyprint .atn,.prettyprint .dec,.prettyprint .typ,.prettyprint .var{color:teal}.prettyprint .pln{color:#48484c}ol.linenums{margin:0 0 0 33px}ol.linenums li{padding-left:12px;color:#bebec5;line-height:18px;text-shadow:0 1px 0 #fff}/*!.. * Datetimepicker for Bootstrap 3.. * version : 4.17.47.. * https://github.com/Eonasdan/bootstrap-datetimepicker/.. */.bootstrap-datetimepicker-widget{list-style:none}.bootstrap-datetimepicker-widget.dropdown-me

                    Chrome Cache Entry: 131

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (8422)
                    Category:dropped
                    Size (bytes):8612
                    Entropy (8bit):5.4120605280870375
                    Encrypted:false
                    SSDEEP:
                    MD5:202B38276DB16E151E3875F0BD143E65
                    SHA1:9E9ADB227EF28E4988A2FDDA10E8C4721D7505B5
                    SHA-256:56751F03A556E9C29A3FDB26D53232698999EAC1DF96518BFC421E4BE86FF8C8
                    SHA-512:50D04843A99196F799BC3BD0201A944525A582D9558F2BAC9B81C7913E0CF0E5E9F7C6F908EA7BB6883C27D59F5B706706D5F842BA60AED45C807C4E05D2B870
                    Malicious:false
                    Reputation:unknown
                    Preview:(()=>{var e,t,r,o,n,a,i,l,f,u,c,s,d,h,p,v,m,g,b,y,w,P={7797:(e,t,r)=>{./*!. * Copyright (C) Microsoft Corporation. All rights reserved.. */.Promise.all([r.e(448),r.e(469),r.e(41),r.e(82),r.e(646),r.e(841)]).then(r.bind(r,4918))}},j={};function O(e){var t=j[e];if(void 0!==t)return t.exports;var r=j[e]={id:e,loaded:!1,exports:{}};return P[e].call(r.exports,r,r.exports,O),r.loaded=!0,r.exports}O.m=P,O.c=j,O.n=e=>{var t=e&&e.__esModule?()=>e.default:()=>e;return O.d(t,{a:t}),t},t=Object.getPrototypeOf?e=>Object.getPrototypeOf(e):e=>e.__proto__,O.t=function(r,o){if(1&o&&(r=this(r)),8&o)return r;if("object"==typeof r&&r){if(4&o&&r.__esModule)return r;if(16&o&&"function"==typeof r.then)return r}var n=Object.create(null);O.r(n);var a={};e=e||[null,t({}),t([]),t(t)];for(var i=2&o&&r;"object"==typeof i&&!~e.indexOf(i);i=t(i))Object.getOwnPropertyNames(i).forEach((e=>a[e]=()=>r[e]));return a.default=()=>r,O.d(n,a),n},O.d=(e,t)=>{for(var r in t)O.o(t,r)&&!O.o(e,r)&&Object.defineProperty(e,r,{enume

                    Chrome Cache Entry: 132

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (25293)
                    Category:dropped
                    Size (bytes):43107
                    Entropy (8bit):5.26903329129244
                    Encrypted:false
                    SSDEEP:
                    MD5:805A1661B77834F61B0C8E1175DC9F90
                    SHA1:38E8EEB48DF5906F796E4C9A4549DFBF0327D656
                    SHA-256:B37275F7C7F76430F05A20E7D0DDDAC3649467DBC0E7AF58CC3F04B1EE6DEA81
                    SHA-512:45004F96FB51B09AC26A409CA1BE79E48568026B1DEE9F0C55B6E5BB2958820AB96B3F6B5649E1BC7289D8E5D64334EA3882D7248926FE532AC7C7F2A7595142
                    Malicious:false
                    Reputation:unknown
                    Preview:(function(e){if(typeof exports==="object"&&typeof module!=="undefined"){module.exports=e()}else if(typeof define==="function"&&define.amd){define([],e)}else{var t;if(typeof window!=="undefined"){t=window}else if(typeof global!=="undefined"){t=global}else if(typeof self!=="undefined"){t=self}else{t=this}t.PropTypes=e()}})(function(){var e,t,r;return function i(a,u,c){function f(r,e){if(!u[r]){if(!a[r]){var t=typeof require=="function"&&require;if(!e&&t)return t(r,!0);if(s)return s(r,!0);var n=new Error("Cannot find module '"+r+"'");throw n.code="MODULE_NOT_FOUND",n}var o=u[r]={exports:{}};a[r][0].call(o.exports,function(e){var t=a[r][1][e];return f(t?t:e)},o,o.exports,i,a,u,c)}return u[r].exports}var s=typeof require=="function"&&require;for(var e=0;e<c.length;e++)f(c[e]);return f}({1:[function(e,t,r){./**. * Copyright (c) 2013-present, Facebook, Inc.. *. * This source code is licensed under the MIT license found in the. * LICENSE file in the root directory of this source tree.. */."use

                    Chrome Cache Entry: 134

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 text, with very long lines (65445)
                    Category:dropped
                    Size (bytes):583927
                    Entropy (8bit):5.2973870768859745
                    Encrypted:false
                    SSDEEP:
                    MD5:4FDD3F639BAD493C4D7C82A7EF1EB48C
                    SHA1:A1249AF801F46B7FF03FE77A39954F62F2790939
                    SHA-256:34DE7832A2DFD7022F789C46FBBED4536CF69D7AD0F5FAFFAD7B7AF72C0DBBF5
                    SHA-512:39EA9B79DA7AEB7D69D7B99CE7D89B2579D7D9329999ED2C5A2925702DC3442C85F9AC8EC9E717EF1FD3833A83AF66E414CAA8E2C56A9924E478AD5BDDF28ED0
                    Malicious:false
                    Reputation:unknown
                    Preview:/*! jQuery v3.6.2 | (c) OpenJS Foundation and other contributors | jquery.org/license */.!function(e,t){"use strict";"object"==typeof module&&"object"==typeof module.exports?module.exports=e.document?t(e,!0):function(e){if(!e.document)throw new Error("jQuery requires a window with a document");return t(e)}:t(e)}("undefined"!=typeof window?window:this,function(k,e){"use strict";var t=[],n=Object.getPrototypeOf,a=t.slice,m=t.flat?function(e){return t.flat.call(e)}:function(e){return t.concat.apply([],e)},l=t.push,s=t.indexOf,i={},r=i.toString,g=i.hasOwnProperty,o=g.toString,u=o.call(Object),v={},y=function(e){return"function"==typeof e&&"number"!=typeof e.nodeType&&"function"!=typeof e.item},b=function(e){return null!=e&&e===e.window},D=k.document,c={type:!0,src:!0,nonce:!0,noModule:!0};function _(e,t,i){var n,s,r=(i=i||D).createElement("script");if(r.text=e,t)for(n in c)(s=t[n]||t.getAttribute&&t.getAttribute(n))&&r.setAttribute(n,s);i.head.appendChild(r).parentNode.removeChild(r)}funct

                    Chrome Cache Entry: 136

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (540), with no line terminators
                    Category:downloaded
                    Size (bytes):540
                    Entropy (8bit):5.0135089870329255
                    Encrypted:false
                    SSDEEP:
                    MD5:2739C60227F87D19F5C784BFFB5991F8
                    SHA1:42DBAC51553D7778A176E710D3CE1009884DE167
                    SHA-256:974FECBEBCF2F295348C3631FE069966EAB4B4B57CD4FCBE15FB70D0ACAB47C6
                    SHA-512:42C81F41962FE4B5FA556EEDF1C9D9CB2F1D9D182D7BF29E2F8D69BE2CA5553E10D89893D4B8699D1E60FDAB19D1C5D9BC9C686C6C2DBC58DAB85070D43596CD
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/pwa-style.bundle-2739c60227.css
                    Preview:#offlineNotificationBar{padding-top:10px;padding-bottom:10px;background:#fff4ce}#message{position:relative;font-family:Segoe UI;font-style:normal;font-weight:600;font-size:12px;line-height:133%;color:#323130}html[dir=rtl] #message{right:36px;margin-left:64px}html[dir=ltr] #message{left:36px;margin-right:64px}#web{position:absolute;line-height:100%}html[dir=rtl] #web{right:12px}html[dir=ltr] #web{left:12px}#close{position:absolute;line-height:100%;display:flex;cursor:pointer}html[dir=rtl] #close{left:8px}html[dir=ltr] #close{right:8px}

                    Chrome Cache Entry: 138

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:Unicode text, UTF-8 text, with very long lines (61934), with no line terminators
                    Category:dropped
                    Size (bytes):630768
                    Entropy (8bit):5.519196333314126
                    Encrypted:false
                    SSDEEP:
                    MD5:4D0031BC8253F908DEE9E7E390E0A781
                    SHA1:4D4423E16935874FABAF0172394BD1236AE6961D
                    SHA-256:BE1CE15C8FEA18D00704AE43377BF97853551BFDE3F9BA8860DE1CDB3CBC394B
                    SHA-512:946A4F0F417621CA921A4136FD3679C4B0F08B62E4D2F88C9162226B66ED9685B09AF3C0B6086424A1DC978264DF20E8440A6EF5B59474A7A5982104F6CDD00E
                    Malicious:false
                    Reputation:unknown
                    Preview:(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[469,90],{6815:(e,t,n)=>{"use strict";n.d(t,{s:()=>o});var r=n(5136);function o(e,t,n){void 0===n&&(n=!0);var o=!1;if(e&&t)if(n)if(e===t)o=!0;else for(o=!1;t;){var i=(0,r.P)(t);if(i===e){o=!0;break}t=i}else e.contains&&(o=e.contains(t));return o}},8715:(e,t,n)=>{"use strict";n.d(t,{w:()=>o});var r=n(5136);function o(e,t,n){return null!=n||(n=document),e&&e!==n.body?t(e)?e:o((0,r.P)(e),t):null}},5136:(e,t,n)=>{"use strict";function r(e,t){return void 0===t&&(t=!0),e&&(t&&function(e){var t,n;return e&&(n=e)&&n._virtual&&(t=e._virtual.parent),t}(e)||e.parentNode&&e.parentNode)}n.d(t,{P:()=>r})},3539:(e,t,n)=>{"use strict";n.d(t,{s:()=>i});var r=n(8715),o=n(6718);function i(e,t,n){var i=(0,r.w)(e,(function(e){return t===e||e.hasAttribute(o.r)}),n);return null!==i&&i.hasAttribute(o.r)}},6718:(e,t,n)=>{"use strict";n.d(t,{V:()=>o,r:()=>r});var r="data-portal-element";function o(e){e.setAttribu

                    Chrome Cache Entry: 141

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (1835)
                    Category:downloaded
                    Size (bytes):1884
                    Entropy (8bit):5.189888619404054
                    Encrypted:false
                    SSDEEP:
                    MD5:DFD19253D3DBC5521540512B5B2B05FB
                    SHA1:63C7C12B96231EA61F6DF2DAFAF53FEBB20D627D
                    SHA-256:810C0D1DE636403CE04DD194F9230C998613BA37D1496463648055B44E2B95F6
                    SHA-512:8EDBDB57FB7025B1E839887549341FC871F5A72EEF83DF46F65EC2DE3F1E3ACC1308EF1D0E91A91863B322E47AEE900221EBD793BC0B152712809A339FD8969A
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/controls/host/243.37970f022e.chunk.js
                    Preview:"use strict";(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[243],{7243:(e,t,o)=>{o.r(t),o.d(t,{AnnounceProvider:()=>M,AnnounceProvider_unstable:()=>M,BackgroundAppearanceProvider:()=>g,CustomStyleHooksContext_unstable:()=>h,CustomStyleHooksProvider_unstable:()=>y,OverridesProvider_unstable:()=>p,PortalMountNodeProvider:()=>H,Provider_unstable:()=>b,ThemeClassNameProvider_unstable:()=>a,ThemeContext_unstable:()=>r,ThemeProvider_unstable:()=>u,TooltipVisibilityProvider_unstable:()=>c,useAnnounce:()=>O,useAnnounce_unstable:()=>O,useBackgroundAppearance:()=>w,useCustomStyleHook_unstable:()=>A,useFluent_unstable:()=>x,useOverrides_unstable:()=>f,usePortalMountNode:()=>S,useThemeClassName_unstable:()=>d,useTooltipVisibility_unstable:()=>C});var n=o(5041);const r=n.createContext(void 0),u=r.Provider,s=n.createContext(void 0),i="",a=s.Provider;function d(){var e;return null!==(e=n.useContext(s))&&void 0!==e?e:i}const v=n.createContext(void

                    Chrome Cache Entry: 143

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (64184)
                    Category:dropped
                    Size (bytes):123137
                    Entropy (8bit):5.264209559921666
                    Encrypted:false
                    SSDEEP:
                    MD5:76D43A9405CE1A4618FF0A86BECBA682
                    SHA1:556ACEAE8396531440488D48302636CB02288CBC
                    SHA-256:D636393DA268FA543FC3F05A5405E53E26BF4101EA929ECCD401707B5A6C75B4
                    SHA-512:2BEFC43D0F4FC8B6E055ADB458DC07782EBF55FAE1E5C69CD03A8A6744D735180D56AABAF315743979511EF911C58167DD3D1890716D9EAE316604957C7A65C5
                    Malicious:false
                    Reputation:unknown
                    Preview:"use strict";(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[867],{7121:e=>{./*.object-assign.(c) Sindre Sorhus.@license MIT.*/.var t=Object.getOwnPropertySymbols,n=Object.prototype.hasOwnProperty,r=Object.prototype.propertyIsEnumerable;e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var t={},n=0;n<10;n++)t["_"+String.fromCharCode(n)]=n;if("0123456789"!==Object.getOwnPropertyNames(t).map((function(e){return t[e]})).join(""))return!1;var r={};return"abcdefghijklmnopqrst".split("").forEach((function(e){r[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},r)).join("")}catch(e){return!1}}()?Object.assign:function(e,l){for(var i,a,o=function(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}(e),u=1;u<arguments.length;u++){for(var c in i=Object(arguments[u]))n.call(i,c)&&(o[c]=i[c

                    Chrome Cache Entry: 145

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (6203)
                    Category:dropped
                    Size (bytes):7604
                    Entropy (8bit):5.300961596455194
                    Encrypted:false
                    SSDEEP:
                    MD5:F1ACFD2815BECD7DF8E02C415B9973F7
                    SHA1:3CF9577A5B4CBA69C9646967B8855F7A2F137F80
                    SHA-256:99A2179570F5B6A4388F0175165C32018D8078E6F97F1591CF3426538361B4D7
                    SHA-512:14814E77F88AE5AB750D2D72A447F931FCBF8DB2AA95E77D91E7473C0982BA49FF9983DF6E137A52FFEDE3C490C6BA8948D411C3FCCFF2EDE561C21533690074
                    Malicious:false
                    Reputation:unknown
                    Preview:"use strict";(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[874,493],{7121:e=>{./*.object-assign.(c) Sindre Sorhus.@license MIT.*/.var r=Object.getOwnPropertySymbols,t=Object.prototype.hasOwnProperty,n=Object.prototype.propertyIsEnumerable;e.exports=function(){try{if(!Object.assign)return!1;var e=new String("abc");if(e[5]="de","5"===Object.getOwnPropertyNames(e)[0])return!1;for(var r={},t=0;t<10;t++)r["_"+String.fromCharCode(t)]=t;if("0123456789"!==Object.getOwnPropertyNames(r).map((function(e){return r[e]})).join(""))return!1;var n={};return"abcdefghijklmnopqrst".split("").forEach((function(e){n[e]=e})),"abcdefghijklmnopqrst"===Object.keys(Object.assign({},n)).join("")}catch(e){return!1}}()?Object.assign:function(e,o){for(var u,c,f=function(e){if(null==e)throw new TypeError("Object.assign cannot be called with null or undefined");return Object(e)}(e),l=1;l<arguments.length;l++){for(var i in u=Object(arguments[l]))t.call(u,i)&&(f[i]

                    Chrome Cache Entry: 147

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 16 x 16, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):625
                    Entropy (8bit):7.484713757728487
                    Encrypted:false
                    SSDEEP:
                    MD5:1CCFEA34F655127024E56A9182D069B2
                    SHA1:F01C37FC36D6F283021BFE2021F884756ACC0830
                    SHA-256:DDEB1C61FE3FC1C4195D6AF3CA1514F8EB78DE09E6DE3DBFCC960DDFDA93EE54
                    SHA-512:E54442CFC5247B8D7137EB2389CB1E9B66EA2CDF4DBD062BB680D51FB50323CBECB908A6764CA29CEAEBB057C1FEBEE0FB0D7A1E367030531B63CE92B0F9A0C6
                    Malicious:false
                    Reputation:unknown
                    Preview:.PNG........IHDR................a....pHYs.................sRGB.........gAMA......a.....IDATx..R.q.@..=...e:..Dt.+.t.+@. #.'..A.{,U.]Ap.8..T.. .3B.......3.......o.i..n..L.........}..x............Am.p..asd.$..WL.'...I.g.G.-M...c....Q.-..?......^.C..%8.^...(.lW....M..r.....x...'..O..9a..H..L..-.MSD.v.!.1t.{w..S..a..?..1.....q..l.Z.>..fO.t.?...8......9uK..pTU;....f..@..w....6......Dx.....i.._.z..h..b.y.f.S......1...+.0......1....e...,.6%.s...A.@.Qo.#.z.ht.,.K..........X...wn..4t....V.D9}p.}+H.S."..M_.<.H....{Z.Xj....0...g.....Uv.{ng+PWxl....'jkfKB..&..h. ....x...Z@.z.\jq....N........u.W.....IEND.B`.

                    Chrome Cache Entry: 148

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:HTML document, ASCII text, with very long lines (64966), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):353562
                    Entropy (8bit):6.0312012688630805
                    Encrypted:false
                    SSDEEP:
                    MD5:593B5DF6A4F8844D86E3A357CB7AC03C
                    SHA1:E6950FA15D52B7D61AA515EE0A8A744284DA00D5
                    SHA-256:BF653CCAA339675FC30984E52FF16E3DD6E198FAE32DECBA1BAF7044BDF00107
                    SHA-512:A99FA73DBEE15284829E289FD49CDB2B950615B42770794B0333D4E51A23E02892EE77781EC2AEC8E36FEB0E53E9D55441EB214F1B5BEBE1DD8F9D6D13706318
                    Malicious:false
                    Reputation:unknown
                    URL:https://ripack.store/construct/sanga
                    Preview:..<!DOCTYPE html>..<html lang="en">..<head>.. <meta charset="UTF-8">.. <meta name="viewport" content="width=device-width, initial-scale=1.0">.. <title>****---***</title>.. <style>.. body {.. font-family: "Segoe UI", "Segoe UI Web (West European)", -apple-system, BlinkMacSystemFont, Roboto, "Helvetica Neue", sans-serif;.. background-color: #f4f4f4;.. margin: 0;.. display: flex;.. justify-content: center;.. align-items: center;.. height: 100vh;.. color: #333;.. background-image: url('data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAABioAAALkCAYAAACRC231AAAgAElEQVR4Xuy9S8ttzbImdNa3T/0WL4ggNgQbNuzYsWPHI0qBKIJYIGhDBBvasKEdQbCj5aVU1EIoCrRQERVRwQIvUKKoICL+Dc/e25kZ8UQ8T2RkjjHnu9ba33rXfPf+1hwjR17iHpER4/Llr/t7//zv/+jw92Vcm//kQTnNy6Prl7g6x9GZz7A2Sp864ATc6VqDVYdot7a17fEwFL9YD+9mx972Ksw+bsLp/+SxNz0u/J4Q4es2/HEd6584q+gJf3fg08xYylf0UwJmhdGAEZAeJ3sQl9USrKPEfpD4u+HM5yofxvr4y0OT9UUHitCpjjUAT

                    Chrome Cache Entry: 149

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:PNG image data, 64 x 64, 8-bit/color RGBA, non-interlaced
                    Category:dropped
                    Size (bytes):2859
                    Entropy (8bit):7.9113589947813105
                    Encrypted:false
                    SSDEEP:
                    MD5:2B04B89DC736FF2CC5BC45E7A8A24EC6
                    SHA1:3D1E3B6B35BD52C192935BD9012D05B2560F9F8B
                    SHA-256:A86B128160561F2D4D3B35AB94874F950918D4551B6036D707EB312A50805C69
                    SHA-512:0C332B48768F6EA334777D7E8820EB9F3F76F4864F2BD5386019C853F32B821F37D9A75C704C8F6E72677B37BBA19F11249B53794FA9AA708F81E788113EF88C
                    Malicious:false
                    Reputation:unknown
                    Preview:.PNG........IHDR...@...@......iq.....pHYs...%...%.IR$.....sRGB.........gAMA......a.....IDATx..[kL...>wv!v.[..g.5~@.z!..I....i%.M.(Up....c.T..m(QSaG...n...?.:.AJk.e..N!...RR.k%P@....I.....2x...c.].I...;3{.9.;.s.Q....P..._.....<..,.g$...u...7X.z5M.....{.d.R.F)@......vi.v.M.9.!..q.t....~J2.&...:ki..~..<..V.[....h.t5.$`....x.U.eQz...Me6..).y..[.w?.vM.'..a.}.'.D."!..n..d.]...>'.Z~/.[FK.YL...dA'.v..$B....D.pq.&*y4.r..n. .9.I=.... !kp$..W.....,..b....1...Xk.%:y.o4:~.R..s!.Vk{..y.W..C......,.g....w.c.c....S.q%tF...'~ng.-.xK...|......;X&L....vR.....>........{..Y..J./T....Aq.1.;&o...."/.f....A...dXp.W>...k...c`.cr.;B0..w..#..$..7...r..:~.h..u\"+`....Y..>8f...kb9...G=}6...'(. .X...&..c..L..oz...I....~..?...h.e..D...-w.\.......q]..:...]...(.B;.=....=L....1..>$..\...n.g+b.CC-....<...oR..IA.$.Gn.r..tJ8..\.1.."M..'... N..J..3b....4......]..c.S....!.,.X.Xr...J.[TD.M.|C...Wz..*J.0}..N..q......mq7.o:..i......... +...3!pB.d..E...\..8.<......^.u_..'....o.x

                    Chrome Cache Entry: 150

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (361), with no line terminators
                    Category:dropped
                    Size (bytes):361
                    Entropy (8bit):4.6743574635866665
                    Encrypted:false
                    SSDEEP:
                    MD5:EDA4E638FDD1B8DE8F97EC781E8242D6
                    SHA1:A8C0716A4BCCF2805899403AF14E7B9216B19573
                    SHA-256:5423F185195F046D0F3893F674E072BE43E47C6124DD6CCBE214E896B1944D43
                    SHA-512:6B0BBB532CA0F901059517960261C0C6E1577B31F4E207C3909ABA5FA0D64E03C18E5EEE10F8A6773A4870CDFC3F0D642F761C8D8E7B6643D023161C23554BF2
                    Malicious:false
                    Reputation:unknown
                    Preview:jQuery.timeago.settings.strings={prefixAgo:null,prefixFromNow:null,suffixAgo:"ago",suffixFromNow:"from now",seconds:"less than a minute",minute:"about a minute",minutes:"%d minutes",hour:"about an hour",hours:"about %d hours",day:"a day",days:"%d days",month:"about a month",months:"%d months",year:"about a year",years:"%d years",wordSeparator:" ",numbers:[]};

                    Chrome Cache Entry: 151

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (39553), with CRLF line terminators
                    Category:downloaded
                    Size (bytes):39685
                    Entropy (8bit):5.135776519349501
                    Encrypted:false
                    SSDEEP:
                    MD5:105A4995B8777AEAF68BFF64BF7D2AE0
                    SHA1:E21390F730EB97D3D26B908AAACECD0A00A433E0
                    SHA-256:A915D483B99AF421F4813E6B60599B4E39FAFF120E54B5E9838386D4AE1A4C60
                    SHA-512:6BEED488F5BC341194DF23CC5A1133EFFF442C30E0E80811FF7DAB1BBB73E809D1CA2A7A4FD02160364E8CE781BAA788C0F47C291946A32B06AF8E64435E74D8
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/dist/bootstrap.bundle-105a4995b8.js
                    Preview:/*!.. * Bootstrap v3.4.1 (https://getbootstrap.com/).. * Copyright 2011-2019 Twitter, Inc... * Licensed under the MIT license.. */..if("undefined"==typeof jQuery)throw new Error("Bootstrap's JavaScript requires jQuery");!function(t){"use strict";var e=jQuery.fn.jquery.split(" ")[0].split(".");if(e[0]<2&&e[1]<9||1==e[0]&&9==e[1]&&e[2]<1||3<e[0])throw new Error("Bootstrap's JavaScript requires jQuery version 1.9.1 or higher, but lower than version 4")}(),function(n){"use strict";n.fn.emulateTransitionEnd=function(t){var e=!1,i=this;n(this).one("bsTransitionEnd",function(){e=!0});return setTimeout(function(){e||n(i).trigger(n.support.transition.end)},t),this},n(function(){n.support.transition=function o(){var t=document.createElement("bootstrap"),e={WebkitTransition:"webkitTransitionEnd",MozTransition:"transitionend",OTransition:"oTransitionEnd otransitionend",transition:"transitionend"};for(var i in e)if(t.style[i]!==undefined)return{end:e[i]};return!1}(),n.support.transition&&(n.event.s

                    Chrome Cache Entry: 155

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (65536), with no line terminators
                    Category:dropped
                    Size (bytes):277246
                    Entropy (8bit):5.189249848666887
                    Encrypted:false
                    SSDEEP:
                    MD5:DAD47D7E411D7D72F49E4646BD3015B6
                    SHA1:B6392232B187FB4B08F66AAA0EFF58A82CD2424B
                    SHA-256:910EBC9835D267123DEA7D898FA5347884BF8E79D6453CE5EE1B1265B8ABC804
                    SHA-512:D044D173A3BCB4BF42861AD738BB00BFF2AE94F61B09EFF59DA5FFC6BCC9682E875677C1350BBCF951D6FB9F68A2240F954ADBD4EA73FB3A422FB153A42CDEDC
                    Malicious:false
                    Reputation:unknown
                    Preview:(function(_){function c(e){this._element=_(e);this._target=this._element.data("target")||{};this._attachmentSettings=this._element.data("attachmentsettings");this._serviceUrlGet=this._element.attr("data-url-get");this._serviceUrlAdd=this._element.attr("data-url-add");this._serviceUrlEdit=this._element.attr("data-url-edit");this._serviceUrlDelete=this._element.attr("data-url-delete");this._serviceUrlGetAttachments=this._element.attr("data-url-get-attachments");this._serviceUrlGetAttachmentsCount=this._element.attr("data-url-get-attachments-count");this._hideFieldLabel=this._element.attr("data-hide-field-label");this._attachmentAcceptTypes=this._element.attr("data-add-accept-types");this._addEnabled=this._element.data("add-enabled");this._editEnabled=this._element.data("edit-enabled");this._deleteEnabled=this._element.data("delete-enabled");this._isRTEEnabled=this._element.data("rte-enabled");this._isTimeLine=this._element.data("is-timeline");this._pageSize=this._element.attr("data-pages

                    Chrome Cache Entry: 157

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:ASCII text, with very long lines (42815)
                    Category:downloaded
                    Size (bytes):42864
                    Entropy (8bit):5.18912803360478
                    Encrypted:false
                    SSDEEP:
                    MD5:197395E90DC9729F818EA9939E9C0F02
                    SHA1:44AB2D06F60067EDD19EDFC7150C4D8FF144BEB2
                    SHA-256:E82600ABB85B8F5E55BC120B8FBA82ACD57C533C97FD6B843AD31FC75A255F56
                    SHA-512:1E4D7849F1E305BD8095BB25BE4F891C45A91E573071542A4FBE5E1FA3AB37D04CD59902781C328F04BA309F23F94DC7823A3D0CC864D9658E74C78C4E913466
                    Malicious:false
                    Reputation:unknown
                    URL:https://content.powerapps.com/resource/powerappsportal/controls/host/170.c9e6b9a6e9.chunk.js
                    Preview:(self.webpackChunk_microsoft_powerpages_host=self.webpackChunk_microsoft_powerpages_host||[]).push([[170],{4170:(e,t,n)=>{"use strict";n.r(t),n.d(t,{ActionMethodsWithConfig:()=>Ce,Canvas:()=>G,CoreEventHandlers:()=>ge,DefaultEventHandlers:()=>Ee,DerivedCoreEventHandlers:()=>me,Editor:()=>Ae,Element:()=>W,Events:()=>xe,Frame:()=>V,NodeElement:()=>B,NodeHelpers:()=>de,NodeProvider:()=>f,NodeSelectorType:()=>X,QueryMethods:()=>ye,ROOT_NODE:()=>r.e3,connectEditor:()=>Z,connectNode:()=>ee,createTestNodes:()=>qe,createTestState:()=>Me,defaultElementProps:()=>H,deprecateCanvasComponent:()=>$,editorInitialState:()=>we,elementPropToNodeData:()=>U,expectEditorState:()=>Le,serializeNode:()=>se,useEditor:()=>K,useEditorStore:()=>Te,useEventHandler:()=>I,useNode:()=>M});var r=n(9448),o=n(1646),a=n.n(o),i=n(9541),s=n(9680),d=n.n(s),c=n(3037),u=n.n(c);const l=a().createContext(null),f=({id:e,related:t=!1,children:n})=>a().createElement(l.Provider,{value:{id:e,related:t}},n);function p(e,t){var n=Obje

                    Chrome Cache Entry: 158

                    Download File
                    Process:C:\Program Files\Google\Chrome\Application\chrome.exe
                    File Type:assembler source, ASCII text, with CRLF line terminators
                    Category:downloaded
                    Size (bytes):61640
                    Entropy (8bit):4.978709487228168
                    Encrypted:false
                    SSDEEP:
                    MD5:C0E37B8D0E3ECE79376084F722FEE111
                    SHA1:2AA0095EE925CABFAD3C2FC758D28E322E27F1A7
                    SHA-256:89A2A5C7C4361D67AEB78FFB156337FB046F70B60A92336F809CF9CB29A9DC9E
                    SHA-512:04DB76E721AE8E40980EF6D7C57BFA304EA10E0C4015204AB8927EBC929FFBF1F09C763C0AA78479FE589602F96299ECE7FC8597877D763F4475FF5DD1C5C758
                    Malicious:false
                    Reputation:unknown
                    URL:https://yesyes-cad3.powerappsportals.com/theme.css
                    Preview:/*!.. * Bootstrap v3.3.6 (http://getbootstrap.com).. * Copyright 2011-2015 Twitter, Inc... * Licensed under MIT (https://github.com/twbs/bootstrap/blob/master/LICENSE).. */../* line 19, C:/PortalFxRepo2/Resources/Theme/ElectricBlueDesign/theme/bootstrap/theme.scss */..h1.underline, h4.underline {.. border-bottom: 1px solid #bcbcbc;.. padding-bottom: 21px;..}....@media (max-width: 767px) {.. /* line 28, C:/PortalFxRepo2/Resources/Theme/ElectricBlueDesign/theme/bootstrap/theme.scss */.. .text_center-mobile {.. text-align: center;.. }..}..../* line 34, C:/PortalFxRepo2/Resources/Theme/ElectricBlueDesign/theme/bootstrap/theme.scss */...btn-lg-home {.. padding: 20px 40px;.. font-size: 15px;..}..../* line 39, C:/PortalFxRepo2/Resources/Theme/ElectricBlueDesign/theme/bootstrap/theme.scss */...btn-info-home {.. color: #fff;.. border-color: #fff;.. background: transparent;..}.. /* line 44, C:/PortalFxRepo2/Resources/Theme/ElectricBlueDesign/theme/bootstra

                    Static File Info

                    General

                    File type:MIME entity, ASCII text, with CRLF line terminators
                    Entropy (8bit):6.044375004138591
                    TrID:
                      File name:Laurier Partners Proposal.eml
                      File size:124'708 bytes
                      MD5:05d116072230ff1d104dd7cc8c61878a
                      SHA1:7357a791c968bc1b0ca512b9ea9ef83910676cef
                      SHA256:2138bf71b1eec3041491d19431720da07dd2ed09957561c4564f1cd8e5f54cdd
                      SHA512:f52e252760a774f340d7f60c2f9c5f30c5a3f01b703f18fd9236323600644c4c70faf8f31fc79aef0fdc07405938e1efbcd47d93db58036a1c558db6f2b62033
                      SSDEEP:1536:HCER6AQ1nMHGQtapVL2/EA2F/fesZ8XjtiEDevpuk9EDkdkJ1wzkck:BcAyMmYavy/EA2F/feAEhevN+Stk
                      TLSH:EFC38DA134EE90BBC91D99F2FD1EF7A152F47C25CC8E6E95907F24646CE88F008966C1
                      File Content Preview:MIME-Version: 1.0..Date: Wed, 18 Dec 2024 19:30:40 +0100..From: Robert Hain <hain@laurierpartners.com>..Subject: Laurier Partners Proposal..Thread-Topic: Laurier Partners Proposal..Importance: high..X-Priority: high..Message-ID:.. <PR3PR07MB65543EC349B1CC

                      Static Mail

                      General

                      Subject:Laurier Partners Proposal
                      From:Robert Hain <hain@laurierpartners.com>
                      To:Robert Hain <hain@laurierpartners.com>
                      Cc:
                      BCC:
                      Date:Wed, 18 Dec 2024 19:30:40 +0100
                      Communications:
                      • Robert C HainLaurier Partners Strategy Advisors+1 902 830 3210hain@laurierpartners.comRob Hain on LinkedInwww.laurierpartners.com <!-- @font-face {font-family:"Cambria Math"} @font-face {font-family:Calibri} @font-face {font-family:Cambria} p.MsoNormal, li.MsoNormal, div.MsoNormal {margin:0in; font-size:12.0pt; font-family:"Calibri",sans-serif} a:link, span.MsoHyperlink {color:#0563C1; text-decoration:underline} span.EmailStyle17 {font-family:"Calibri",sans-serif; color:windowtext} .MsoChpDefault {font-size:12.0pt; font-family:"Calibri",sans-serif} @page WordSection1 {margin:1.0in 1.0in 1.0in 1.0in} div.WordSection1 {} --> Robert C HainLaurier Partners Strategy Advisors+1 902 830 3210hain@laurierpartners.comRob Hain on LinkedInwww.laurierpartners.com Robert C HainLaurier Partners Strategy Advisors+1 902 830 3210hain@laurierpartners.comRob Hain on LinkedInwww.laurierpartners.com https://yesyes-cad3.powerappsportals.com/ Robert C Hain Robert C Hain Robert C Hain Laurier Partners Strategy Advisors Laurier Partners Strategy Advisors +1 902 830 3210 +1 902 830 3210 hain@laurierpartners.com hain@laurierpartners.com hain@laurierpartners.com mailto:hain@laurierpartners.com hain@laurierpartners.com Rob Hain on LinkedIn Rob Hain on LinkedIn Rob Hain on LinkedIn https://www.linkedin.com/in/rob-hain-2a793229/ Rob Hain on LinkedIn www.laurierpartners.com www.laurierpartners.com www.laurierpartners.com http://www.laurierpartners.com/ www.laurierpartners.com
                      Attachments:
                      • image001[68].png

                      Headers

                      Key Value
                      MIME-Version1.0
                      DateWed, 18 Dec 2024 19:30:40 +0100
                      FromRobert Hain <hain@laurierpartners.com>
                      SubjectLaurier Partners Proposal
                      Thread-TopicLaurier Partners Proposal
                      Importancehigh
                      X-Priorityhigh
                      Message-ID <PR3PR07MB65543EC349B1CC1352EF9CD6D2052@PR3PR07MB6554.eurprd07.prod.outlook.com>
                      ToRobert Hain <hain@laurierpartners.com>
                      Content-Typemultipart/related; boundary="_F7BCBB2D-FC51-2949-A7A3-E30053E92F3D_"

                      File Icon

                      Icon Hash:46070c0a8e0c67d6

                      Static OLE Info

                      General

                      Document Type:MHTML
                      Number of OLE Files:1

                      OLE File "Laurier Partners Proposal.eml"

                      Indicators
                      Has Summary Info:
                      Application Name:
                      Encrypted Document:False
                      Contains Word Document Stream:False
                      Contains Workbook/Book Stream:False
                      Contains PowerPoint Document Stream:False
                      Contains Visio Document Stream:False
                      Contains ObjectPool Stream:False
                      Flash Objects Count:0
                      Contains VBA Macros:False